9
CVE-2021-34417
- EPSS 0.49%
- Veröffentlicht 11.11.2021 23:15:09
- Zuletzt bearbeitet 21.11.2024 06:10:21
- Quelle security@zoom.us
- Teams Watchlist Login
- Unerledigt Login
The network proxy page on the web portal for the Zoom On-Premise Meeting Connector Controller before version 4.6.365.20210703, Zoom On-Premise Meeting Connector MMR before version 4.6.365.20210703, Zoom On-Premise Recording Connector before version 3.8.45.20210703, Zoom On-Premise Virtual Room Connector before version 4.4.6868.20210703, and Zoom On-Premise Virtual Room Connector Load Balancer before version 2.5.5496.20210703 fails to validate input sent in requests to set the network proxy password. This could lead to remote command injection by a web portal administrator.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Zoom ≫ Zoom On-premise Meeting Connector Controller Version < 4.6.365.20210703
Zoom ≫ Zoom On-premise Meeting Connector Mmr Version < 4.6.365.20210703
Zoom ≫ Zoom On-premise Recording Connector Version < 3.8.45.20210703
Zoom ≫ Zoom On-premise Virtual Room Connector Version < 4.4.6868.20210703
Zoom ≫ Zoom On-premise Virtual Room Connector Load Balancer Version < 2.5.5496.20210703
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.49% | 0.629 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 7.2 | 1.2 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 9 | 8 | 10 |
AV:N/AC:L/Au:S/C:C/I:C/A:C
|
| security@zoom.us | 7.9 | 1.5 | 5.8 |
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
|
CWE-20 Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.