CVE-2021-34418
Medium
Description
The login routine of the web console in the Zoom On-Premise Meeting Connector before version 4.6.239.20200613, Zoom On-Premise Meeting Connector MMR before version 4.6.239.20200613, Zoom On-Premise Recording Connector before version 3.8.42.20200905, Zoom On-Premise Virtual Room Connector before version 4.4.6344.20200612, and Zoom On-Premise Virtual Room Connector Load Balancer before version 2.5.5492.20200616 fails to validate that a NULL byte was sent while authenticating. This could lead to a crash of the login service.
SeverityMedium
CVSS4.0
Exploit probability—
Product
Zoom On-premise Meeting Connector Controller
PublishedNov 11, 2021
First seenNov 11, 2021
How to fix
Update
- zoom zoom_on-premise_meeting_connector_controller4.6.239.20200613 or later
- zoom zoom_on-premise_meeting_connector_mmr4.6.239.20200613 or later
- zoom zoom_on-premise_recording_connector3.8.42.20200905 or later
- zoom zoom_on-premise_virtual_room_connector4.4.6344.20200612 or later
- zoom zoom_on-premise_virtual_room_connector_load_balancer2.5.5492.20200616 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zoom zoom_on-premise_meeting_connector_controller | v < 4.6.239.20200613 | 4.6.239.20200613 |
| zoom zoom_on-premise_meeting_connector_mmr | v < 4.6.239.20200613 | 4.6.239.20200613 |
| zoom zoom_on-premise_recording_connector | v < 3.8.42.20200905 | 3.8.42.20200905 |
| zoom zoom_on-premise_virtual_room_connector | v < 4.4.6344.20200612 | 4.4.6344.20200612 |
| zoom zoom_on-premise_virtual_room_connector_load_balancer | v < 2.5.5492.20200616 | 2.5.5492.20200616 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.