CVE-2021-34417

Authenticated remote command execution with root privileges via web console in MMR

Severity Score

7.2

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The network proxy page on the web portal for the Zoom On-Premise Meeting Connector Controller before version 4.6.365.20210703, Zoom On-Premise Meeting Connector MMR before version 4.6.365.20210703, Zoom On-Premise Recording Connector before version 3.8.45.20210703, Zoom On-Premise Virtual Room Connector before version 4.4.6868.20210703, and Zoom On-Premise Virtual Room Connector Load Balancer before version 2.5.5496.20210703 fails to validate input sent in requests to set the network proxy password. This could lead to remote command injection by a web portal administrator.

La página del proxy de red en el portal web para Zoom On-Premise Meeting Connector Controller versiones anteriores a 4.6.365.20210703, Zoom On-Premise Meeting Connector MMR versiones anteriores a 4.6.365.20210703, Zoom On-Premise Recording Connector versiones anteriores a 3. 8.45.20210703, Zoom On-Premise Virtual Room Connector versiones anteriores a 4.4.6868.20210703, y Zoom On-Premise Virtual Room Connector Load Balancer versiones anteriores a 2.5.5496.20210703, no comprueba la entrada enviada en las peticiones para establecer la contraseña del proxy de red. Esto podría conllevar la inyección de comandos remotos por parte de un administrador del portal web

*Credits: Jeremy Brown

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Attack Vector

Network

Attack Complexity

Low

Authentication

Single

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2021-06-09 CVE Reserved
2021-11-11 CVE Published
2023-06-04 EPSS Updated
2024-09-16 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-20: Improper Input Validation

CAPEC

References (1)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://explore.zoom.us/en/trust/security/security-bulletin	2021-11-16

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Zoom Search vendor "Zoom"		Zoom On-premise Meeting Connector Controller Search vendor "Zoom" for product "Zoom On-premise Meeting Connector Controller"				< 4.6.365.20210703 Search vendor "Zoom" for product "Zoom On-premise Meeting Connector Controller" and version " < 4.6.365.20210703"		-		Affected
Zoom Search vendor "Zoom"		Zoom On-premise Meeting Connector Mmr Search vendor "Zoom" for product "Zoom On-premise Meeting Connector Mmr"				< 4.6.365.20210703 Search vendor "Zoom" for product "Zoom On-premise Meeting Connector Mmr" and version " < 4.6.365.20210703"		-		Affected
Zoom Search vendor "Zoom"		Zoom On-premise Recording Connector Search vendor "Zoom" for product "Zoom On-premise Recording Connector"				< 3.8.45.20210703 Search vendor "Zoom" for product "Zoom On-premise Recording Connector" and version " < 3.8.45.20210703"		-		Affected
Zoom Search vendor "Zoom"		Zoom On-premise Virtual Room Connector Search vendor "Zoom" for product "Zoom On-premise Virtual Room Connector"				< 4.4.6868.20210703 Search vendor "Zoom" for product "Zoom On-premise Virtual Room Connector" and version " < 4.4.6868.20210703"		-		Affected
Zoom Search vendor "Zoom"		Zoom On-premise Virtual Room Connector Load Balancer Search vendor "Zoom" for product "Zoom On-premise Virtual Room Connector Load Balancer"				< 2.5.5496.20210703 Search vendor "Zoom" for product "Zoom On-premise Virtual Room Connector Load Balancer" and version " < 2.5.5496.20210703"		-		Affected