Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-34418

The login routine of the web console in the Zoom On-Premise Meeting Connector before version 4.6.239.20200613, Zoom On-Premise Meeting Connector MMR before version 4.6.239.20200613, Zoom On-Premise Recording Connector before version 3.8.42.20200905, Zoom On-Premise Virtual Room Connector before version 4.4.6344.20200612, and Zoom On-Premise Virtual Room Connector Load Balancer before version 2.5.5492.20200616 fails to validate that a NULL byte was sent while authenticating. This could lead to a crash of the login service.

Published

2021-11-11T23:15:09.467

Last Modified

2024-11-21T06:10:21.713

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 4.0 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-476
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application zoom zoom_on-premise_meeting_connector_controller < 4.6.239.20200613 Yes
Application zoom zoom_on-premise_meeting_connector_mmr < 4.6.239.20200613 Yes
Application zoom zoom_on-premise_recording_connector < 3.8.42.20200905 Yes
Application zoom zoom_on-premise_virtual_room_connector < 4.4.6344.20200612 Yes
Application zoom zoom_on-premise_virtual_room_connector_load_balancer < 2.5.5492.20200616 Yes
References