CVE-2021-34425medium

CVE-2021-34425: medium-severity vulnerability in Zoom Client for Meetings for Android

Server Side Request Forgery in Zoom Client for Meetings chat

Published · Updated

Follow this CVE+ Monitor Zoom Client for Meetings

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.7epss 0.8%
The Zoom Client for Meetings before version 5.7.3 (for Android, iOS, Linux, macOS, and Windows) contain a server side request forgery vulnerability in the chat\'s "link preview" functionality. In versions prior to 5.7.3, if a user were to enable the chat\'s "link preview" feature, a malicious actor could trick the user into potentially sending arbitrary HTTP GET requests to URLs that the actor cannot reach directly.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
Zoom Video Communications Inc · Zoom Client for Meetings for AndroidZoom Video Communications Inc · Zoom Client for Meetings for iOSZoom Video Communications Inc · Zoom Client for Meetings for LinuxZoom Video Communications Inc · Zoom Client for Meetings for macOSZoom Video Communications Inc · Zoom Client for Meetings for Windows
Related CVEs — Zoom Client for Meetings for Android

In the same product, most dangerous first.

CVE-2022-22784HIGHImproper XML Parsing in Zoom Client for MeetingsEPSS 4.1%CVE-2022-22787MEDIUMInsufficient hostname validation during Clusterswitch message in Zoom Client for MeetingsEPSS 3.7%CVE-2022-22785MEDIUMImproperly constrained session cookies in Zoom Client for MeetingsEPSS 3.5%CVE-2022-22780MEDIUMZoom Chat Susceptible to Zip BombingEPSS 1.7%