Lucene search

[email protected]CVE-2021-34417

HistoryNov 12, 2021 - 12:00 a.m.

CVE-2021-34417

2021-11-1200:00:00

CWE-20

[email protected]

web.nvd.nist.gov

zoom

on-premise

meeting connector

mmr

recording connector

virtual room connector

load balancer

command injection

cve-2021-34417

9 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

7.9 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

7.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

50.1%

JSON

The network proxy page on the web portal for the Zoom On-Premise Meeting Connector Controller before version 4.6.365.20210703, Zoom On-Premise Meeting Connector MMR before version 4.6.365.20210703, Zoom On-Premise Recording Connector before version 3.8.45.20210703, Zoom On-Premise Virtual Room Connector before version 4.4.6868.20210703, and Zoom On-Premise Virtual Room Connector Load Balancer before version 2.5.5496.20210703 fails to validate input sent in requests to set the network proxy password. This could lead to remote command injection by a web portal administrator.

Affected configurations

NVD

Node

zoomzoom_on-premise_meeting_connector_controllerRange<4.6.365.20210703

zoomzoom_on-premise_meeting_connector_mmrRange<4.6.365.20210703

zoomzoom_on-premise_recording_connectorRange<3.8.45.20210703

zoomzoom_on-premise_virtual_room_connectorRange<4.4.6868.20210703

zoomzoom_on-premise_virtual_room_connector_load_balancerRange<2.5.5496.20210703

CPENameOperatorVersion
zoom:zoom_on-premise_meeting_connector_controllerzoom zoom on-premise meeting connector controllerlt4.6.365.20210703
zoom:zoom_on-premise_meeting_connector_mmrzoom zoom on-premise meeting connector mmrlt4.6.365.20210703
zoom:zoom_on-premise_recording_connectorzoom zoom on-premise recording connectorlt3.8.45.20210703
zoom:zoom_on-premise_virtual_room_connectorzoom zoom on-premise virtual room connectorlt4.4.6868.20210703
zoom:zoom_on-premise_virtual_room_connector_load_balancerzoom zoom on-premise virtual room connector load balancerlt2.5.5496.20210703

CPE	Name	Operator	Version
zoom:zoom_on-premise_meeting_connector_controller	zoom zoom on-premise meeting connector controller	lt	4.6.365.20210703
zoom:zoom_on-premise_meeting_connector_mmr	zoom zoom on-premise meeting connector mmr	lt	4.6.365.20210703
zoom:zoom_on-premise_recording_connector	zoom zoom on-premise recording connector	lt	3.8.45.20210703
zoom:zoom_on-premise_virtual_room_connector	zoom zoom on-premise virtual room connector	lt	4.4.6868.20210703
zoom:zoom_on-premise_virtual_room_connector_load_balancer	zoom zoom on-premise virtual room connector load balancer	lt	2.5.5496.20210703

CNA Affected

[
  {
    "product": "Zoom On-Premise Meeting Connector Controller",
    "vendor": "Zoom Video Communications Inc",
    "versions": [
      {
        "lessThan": "4.6.365.20210703",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Zoom On-Premise Meeting Connector MMR",
    "vendor": "Zoom Video Communications Inc",
    "versions": [
      {
        "lessThan": "4.6.365.20210703",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Zoom On-Premise Recording Connector",
    "vendor": "Zoom Video Communications Inc",
    "versions": [
      {
        "lessThan": "3.8.45.20210703",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Zoom On-Premise Virtual Room Connector",
    "vendor": "Zoom Video Communications Inc",
    "versions": [
      {
        "lessThan": "4.4.6868.20210703",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Zoom On-Premise Virtual Room Connector Load Balancer",
    "vendor": "Zoom Video Communications Inc",
    "versions": [
      {
        "lessThan": "2.5.5496.20210703",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

explore.zoom.us/en/trust/security/security-bulletin

9 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

7.9 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

7.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

50.1%

JSON

Related for CVE-2021-34417

prion1 nvd1 cvelist1