← Back

CVE-2021-34417

nvd nist
Published: Nov 11, 2021Modified: Jun 17, 2026

JSON object

Loading...
7.2
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Exploitability: 1.2 / Impact: 5.9
Source: NVD

Description

The network proxy page on the web portal for the Zoom On-Premise Meeting Connector Controller before version 4.6.365.20210703, Zoom On-Premise Meeting Connector MMR before version 4.6.365.20210703, Zoom On-Premise Recording Connector before version 3.8.45.20210703, Zoom On-Premise Virtual Room Connector before version 4.4.6868.20210703, and Zoom On-Premise Virtual Room Connector Load Balancer before version 2.5.5496.20210703 fails to validate input sent in requests to set the network proxy password. This could lead to remote command injection by a web portal administrator.

Affected (5)

Zoom
5 products
Zoom On Premise Meeting Connector Controller
Zoom On Premise Meeting Connector Mmr
Zoom On Premise Recording Connector
Zoom On Premise Virtual Room Connector
Zoom On Premise Virtual Room Connector Load Balancer
Configuration A
5 vulnerable
Vulnerable SoftwareAffected Versions
Zoom On Premise Meeting Connector Controller
Before 4.6.365.20210703
Zoom On Premise Meeting Connector Mmr
Before 4.6.365.20210703
Zoom On Premise Recording Connector
Before 3.8.45.20210703
Zoom On Premise Virtual Room Connector
Before 4.4.6868.20210703
Zoom On Premise Virtual Room Connector Load Balancer
Before 2.5.5496.20210703

Related CWEs

CWE-20
Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (2)

Source: security@zoom.us
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.