PT-2021-7428 · Zoom · Zoom Client For Meetings

Published 2021-11-09 · Updated 2021-11-16 · CVE-2021-34419

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zoom Client for Meetings for Ubuntu Linux versions prior to 5.1.0

Description The issue is related to an HTML injection flaw that occurs when sending a remote control request to a user during in-meeting screen sharing. This could allow meeting participants to be targeted for social engineering attacks. The flaw exists due to the failure to neutralize special elements, which may allow a remote attacker to execute arbitrary code.

Recommendations For versions prior to 5.1.0, update to version 5.1.0 or later to resolve the issue. As a temporary workaround, consider disabling the remote control request feature during in-meeting screen sharing until a patch is available.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

BDU:2022-06139

CVE-2021-34419

Affected Products

Zoom Client For Meetings

References · 5

• https://bdu.fstec.ru/vul/2022-06139 · Security Note
• https://explore.zoom.us/en/trust/security/security-bulletin · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-34419 · Security Note
• https://osv.dev/vulnerability/CVE-2021-34419 · Vendor Advisory
• https://t.me/cibsecurity/32270 · Telegram Post