CVE-2021-34425 : The Zoom Client for Meetings before version 5.7.3 (for Android, iOS, Linux, macO

The Zoom Client for Meetings before version 5.7.3 (for Android, iOS, Linux, macOS, and Windows) contain a server side request forgery vulnerability in the chat\'s "link preview" functionality. In versions prior to 5.7.3, if a user were to enable the chat\'s "link preview" feature, a malicious actor could trick the user into potentially sending arbitrary HTTP GET requests to URLs that the actor cannot reach directly.

Published 2021-12-14 20:15:07

Updated 2022-04-12 18:15:32

Source Zoom Video Communications, Inc.

View at NVD, CVE.org

Vulnerability category: Server-side request forgery (SSRF)

Products affected by CVE-2021-34425

Zoom » Meetings
Versions before (<) 5.7.3
cpe:2.3:a:zoom:meetings:*:*:*:*:*:*:*:*
Matching versions
When used together with: Apple » Iphone Os » Version: N/A
When used together with: Apple » Macos » Version: N/A
When used together with: Google » Android » Version: N/A
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2021-34425

EPSS FAQ

0.08%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 34 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-34425

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.0	MEDIUM	AV:N/AC:H/Au:N/C:P/I:P/A:N	4.9	4.9	NIST
Access Vector: Network Access Complexity: High Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: None
6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	2.8	2.7	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: None
4.7	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N	1.6	2.7	Zoom Video Communications, Inc.
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: None

CWE ids for CVE-2021-34425

CWE-918 Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2021-34425

https://explore.zoom.us/en/trust/security/security-bulletin

Security Bulletin | Zoom
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2021-34425

Products affected by CVE-2021-34425

Exploit prediction scoring system (EPSS) score for CVE-2021-34425

CVSS scores for CVE-2021-34425

CWE ids for CVE-2021-34425

References for CVE-2021-34425