Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-34417

The network proxy page on the web portal for the Zoom On-Premise Meeting Connector Controller before version 4.6.365.20210703, Zoom On-Premise Meeting Connector MMR before version 4.6.365.20210703, Zoom On-Premise Recording Connector before version 3.8.45.20210703, Zoom On-Premise Virtual Room Connector before version 4.4.6868.20210703, and Zoom On-Premise Virtual Room Connector Load Balancer before version 2.5.5496.20210703 fails to validate input sent in requests to set the network proxy password. This could lead to remote command injection by a web portal administrator.

Published

2021-11-11T23:15:09.283

Last Modified

2024-11-21T06:10:21.577

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.9 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: SINGLE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

8.0

Impact Score

10.0

Weaknesses
  • Type: Primary
    CWE-20
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application zoom zoom_on-premise_meeting_connector_controller < 4.6.365.20210703 Yes
Application zoom zoom_on-premise_meeting_connector_mmr < 4.6.365.20210703 Yes
Application zoom zoom_on-premise_recording_connector < 3.8.45.20210703 Yes
Application zoom zoom_on-premise_virtual_room_connector < 4.4.6868.20210703 Yes
Application zoom zoom_on-premise_virtual_room_connector_load_balancer < 2.5.5496.20210703 Yes
References