CVE-2021-34425: falha de média gravidade em Zoom Client for Meetings for Android
Server Side Request Forgery in Zoom Client for Meetings chat
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.7epss 0.8%
The Zoom Client for Meetings before version 5.7.3 (for Android, iOS, Linux, macOS, and Windows) contain a server side request forgery vulnerability in the chat\'s "link preview" functionality. In versions prior to 5.7.3, if a user were to enable the chat\'s "link preview" feature, a malicious actor could trick the user into potentially sending arbitrary HTTP GET requests to URLs that the actor cannot reach directly.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
Zoom Video Communications Inc · Zoom Client for Meetings for AndroidZoom Video Communications Inc · Zoom Client for Meetings for iOSZoom Video Communications Inc · Zoom Client for Meetings for LinuxZoom Video Communications Inc · Zoom Client for Meetings for macOSZoom Video Communications Inc · Zoom Client for Meetings for WindowsCVEs relacionadas — Zoom Client for Meetings for Android
No mesmo produto, das mais perigosas para as menos.
CVE-2022-22784HIGHImproper XML Parsing in Zoom Client for MeetingsEPSS 4.1%CVE-2022-22787MEDIUMInsufficient hostname validation during Clusterswitch message in Zoom Client for MeetingsEPSS 3.7%CVE-2022-22785MEDIUMImproperly constrained session cookies in Zoom Client for MeetingsEPSS 3.5%CVE-2022-22780MEDIUMZoom Chat Susceptible to Zip BombingEPSS 1.7%