CVE-2021-34418: falha de média gravidade em Zoom On-Premise Meeting Connector
Pre-auth Null pointer crash in on-premise web console
Publicada em · Atualizada em
Seguir esta CVE+ Monitorar Zoom On-Premise Meeting Connector MMR+ Monitorar Zoom On-Premise Recording Connector
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4epss 0.6%
The login routine of the web console in the Zoom On-Premise Meeting Connector before version 4.6.239.20200613, Zoom On-Premise Meeting Connector MMR before version 4.6.239.20200613, Zoom On-Premise Recording Connector before version 3.8.42.20200905, Zoom On-Premise Virtual Room Connector before version 4.4.6344.20200612, and Zoom On-Premise Virtual Room Connector Load Balancer before version 2.5.5492.20200616 fails to validate that a NULL byte was sent while authenticating. This could lead to a crash of the login service.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Produtos afetados
Zoom Video Communications Inc · Zoom On-Premise Meeting ConnectorZoom Video Communications Inc · Zoom On-Premise Meeting Connector MMRZoom Video Communications Inc · Zoom On-Premise Recording ConnectorZoom Video Communications Inc · Zoom On-Premise Virtual Room ConnectorZoom Video Communications Inc · Zoom On-Premise Virtual Room Connector Load BalancerCVEs relacionadas — Zoom On-Premise Meeting Connector
No mesmo produto, das mais perigosas para as menos.
CVE-2021-34423HIGHBuffer overflow in Zoom client and other productsEPSS 3.3%CVE-2021-34417HIGHAuthenticated remote command execution with root privileges via web console in MMREPSS 1.2%CVE-2022-22783MEDIUMProcess memory exposure in Zoom on-premise Meeting servicesEPSS 1.0%CVE-2022-28761MEDIUMZoom On-Premise Deployments: Improper Access ControlEPSS 0.8%CVE-2022-28758HIGHZoom On-Premise Deployments: Improper Access ControlEPSS 0.7%CVE-2022-28759HIGHZoom On-Premise Deployments: Improper Access ControlEPSS 0.7%