A vulnerability was discovered in the Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.8.4, Zoom Client for Meetings for Blackberry (for Android and iOS) before version 5.8.1, Zoom Client for Meetings for intune (for Android and iOS) before version 5.8.4, Zoom Client for Meetings for Chrome OS before version 5.0.1, Zoom Rooms for Conference Room (for Android, AndroidBali, macOS, and Windows) before version 5.8.3, Controllers for Zoom Rooms (for Android, iOS, and Windows) before version 5.8.3, Zoom VDI Windows Meeting Client before version 5.8.4, Zoom VDI Azure Virtual Desktop Plugins (for Windows x86 or x64, IGEL x64, Ubuntu x64, HP ThinPro OS x64) before version 5.8.4.21112, Zoom VDI Citrix Plugins (for Windows x86 or x64, Mac Universal Installer & Uninstaller, IGEL x64, eLux RP6 x64, HP ThinPro OS x64, Ubuntu x64, CentOS x 64, Dell ThinOS) before version 5.8.4.21112, Zoom VDI VMware Plugins (for Windows x86 or x64, Mac Universal Installer & Uninstaller, IGEL x64, eLux RP6 x64, HP ThinPro OS x64, Ubuntu x64, CentOS x 64, Dell ThinOS) before version 5.8.4.21112, Zoom Meeting SDK for Android before version 5.7.6.1922, Zoom Meeting SDK for iOS before version 5.7.6.1082, Zoom Meeting SDK for macOS before version 5.7.6.1340, Zoom Meeting SDK for Windows before version 5.7.6.1081, Zoom Video SDK (for Android, iOS, macOS, and Windows) before version 1.1.2, Zoom on-premise Meeting Connector before version 4.8.12.20211115, Zoom on-premise Meeting Connector MMR before version 4.8.12.20211115, Zoom on-premise Recording Connector before version 5.1.0.65.20211116, Zoom on-premise Virtual Room Connector before version 4.4.7266.20211117, Zoom on-premise Virtual Room Connector Load Balancer before version 2.5.5692.20211117, Zoom Hybrid Zproxy before version 1.0.1058.20211116, and Zoom Hybrid MMR before version 4.6.20211116.131_x86-64 which potentially allowed for the exposure of the state of process memory. This issue could be used to potentially gain insight into arbitrary areas of the product's memory.
This vulnerability carries a HIGH severity rating with a CVSS v3.1 score of 7.5, indicating it can be exploited remotely over the network with relatively low complexity without requiring user interaction and does not require pre-existing privileges . The vulnerability impacts confidentiality (data exposure), for affected systems. Impacting 30 products from zoom, from google, from apple and 27 others, organizations running these solutions should prioritize assessment and patching.
Reported in 2021, this vulnerability emerged during an era marked by increased sophistication in supply chain attacks, cloud infrastructure vulnerabilities, and software-as-a-service (SaaS) security challenges. Security practices during this period emphasized zero-trust architectures, container security, and API protection.
2021-11-24T17:15:07.807
2024-11-21T06:10:22.600
Modified
CVSSv3.1: 7.5 (HIGH)
AV:N/AC:L/Au:N/C:P/I:N/A:N
10.0
2.9
| Type | Vendor | Product | Version/Range | Vulnerable? |
|---|---|---|---|---|
| Application | zoom | meetings | < 5.8.3 | Yes |
| Operating System | android | - | No | |
| Application | zoom | meetings | < 5.8.4 | Yes |
| Operating System | apple | macos | - | No |
| Application | zoom | meetings | < 5.8.4 | Yes |
| Operating System | apple | iphone_os | - | No |
| Application | zoom | meetings | < 5.8.4 | Yes |
| Operating System | linux | linux_kernel | - | No |
| Application | zoom | meetings | < 5.8.4 | Yes |
| Operating System | microsoft | windows | - | No |
| Application | zoom | meetings_for_blackberry | < 5.8.1 | Yes |
| Operating System | android | - | No | |
| Application | zoom | meetings_for_blackberry | < 5.8.1 | Yes |
| Operating System | apple | iphone_os | - | No |
| Application | zoom | meetings_for_intune | < 5.8.4 | Yes |
| Operating System | apple | iphone_os | - | No |
| Application | zoom | meetings_for_intune | < 5.8.4 | Yes |
| Operating System | android | - | No | |
| Application | zoom | meetings_for_chrome_os | < 5.0.1 | Yes |
| Application | zoom | rooms_for_conference_rooms | < 5.8.3 | Yes |
| Operating System | android | - | No | |
| Application | zoom | rooms_for_conference_rooms | < 5.8.3 | Yes |
| Operating System | apple | macos | - | No |
| Application | zoom | rooms_for_conference_rooms | < 5.8.3 | Yes |
| Operating System | microsoft | windows | - | No |
| Application | zoom | controllers_for_zoom_rooms | < 5.8.3 | Yes |
| Operating System | microsoft | windows | - | No |
| Application | zoom | controllers_for_zoom_rooms | < 5.8.3 | Yes |
| Operating System | apple | iphone_os | - | No |
| Application | zoom | controllers_for_zoom_rooms | < 5.8.3 | Yes |
| Operating System | android | - | No | |
| Application | zoom | virtual_desktop_infrastructure | < 5.8.4 | Yes |
| Application | zoom | android_meeting_sdk | < 5.7.6.1922 | Yes |
| Application | zoom | iphone_os_meeting_sdk | < 5.7.6.1082 | Yes |
| Application | zoom | macos_meeting_sdk | < 5.7.6.1340 | Yes |
| Application | zoom | windows_meeting_sdk | < 5.7.6.1081 | Yes |
| Application | zoom | android_video_sdk | < 1.1.2 | Yes |
| Application | zoom | iphone_os_video_sdk | < 1.1.2 | Yes |
| Application | zoom | macos_video_sdk | < 1.1.2 | Yes |
| Application | zoom | windows_video_sdk | < 1.1.2 | Yes |
| Application | zoom | hybrid_mmr | < 4.6.20211116.131 | Yes |
| Application | zoom | hybrid_zproxy | < 1.0.1058.20211116 | Yes |
| Application | zoom | zoom_on-premise_meeting_connector_controller | < 4.8.12.20211115 | Yes |
| Application | zoom | zoom_on-premise_meeting_connector_mmr | < 4.8.12.20211115 | Yes |
| Application | zoom | zoom_on-premise_recording_connector | < 5.1.0.65.20211116 | Yes |
| Application | zoom | zoom_on-premise_virtual_room_connector | < 4.4.7266.20211117 | Yes |
| Application | zoom | zoom_on-premise_virtual_room_connector_load_balancer | < 2.5.5692.20211117 | Yes |
| Application | zoom | vdi_azure_virtual_desktop | < 5.8.4.21112 | Yes |
| Application | zoom | vdi_citrix | < 5.8.4.21112 | Yes |
| Application | zoom | vdi_vmware | < 5.8.4.21112 | Yes |
SecUtils normalizes and enriches National Vulnerability Database (NVD) records by standardizing vendor and product identifiers, aggregating vulnerability metadata from both NVD and MITRE sources, and providing structured context for security teams. For zoom's affected products, we extract Common Platform Enumeration (CPE) data, Common Weakness Enumeration (CWE) classifications, CVSS severity metrics, and reference data to enable rapid vulnerability prioritization and asset correlation. This record contains no exploit code, proof-of-concept instructions, or attack methodologies—only defensive intelligence necessary for patch management, risk assessment, and security operations.