CVE-2021-34420

Published: Nov 11, 2021Modified: Nov 21, 2024

7.4

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

Exploitability: 2.8 / Impact: 4.0

Source: NVD

Description

The Zoom Client for Meetings for Windows installer before version 5.5.4 does not properly verify the signature of files with .msi, .ps1, and .bat extensions. This could lead to a malicious actor installing malicious software on a customer’s computer.

Affected (1)

Products: Zoom: Zoom Client For Meetings

1 product

Zoom Client For Meetings

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Zoom Zoom Client For Meetings	Before 5.4.4

Related CWEs

Improper Verification of Cryptographic Signature

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

References (4)

https://explore.zoom.us/en/trust/security/security-bulletin

Source: security@zoom.us

Vendor Advisory

https://medium.com/manomano-tech/a-red-team-operation-leveraging-a-zero-day-vulnerability-in-zoom-80f57fb0822e

Source: security@zoom.us

Third Party Advisory

https://explore.zoom.us/en/trust/security/security-bulletin

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://medium.com/manomano-tech/a-red-team-operation-leveraging-a-zero-day-vulnerability-in-zoom-80f57fb0822e

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.