7.8high
CVE-2021-34412
During the installation process for all versions of the Zoom Client for Meetings for Windows before 5.4.0, it is possible to launch Interne…
Published 5 y ago · modified 4 mo ago · JSON
CVSS
7.8
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
0.4%
percentile 38%
Public exploits
0
none known
Summary
During the installation process for all versions of the Zoom Client for Meetings for Windows before 5.4.0, it is possible to launch Internet Explorer. If the installer was launched with elevated privileges such as by SCCM this can result in a local privilege escalation.
Exploit prediction (EPSS)
0.43% probability of exploitation in the next 30 days, higher than 38% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 4.6 | AV:L/AC:L/Au:N/C:P/I:P/A:P |
Affected products
- n/a Zoom Client for Meetings for Windows
Classification
- Weakness
- CWE-269 Improper Privilege Management
References
- explore.zoom.us /en/trust/security/security-bulletin/ · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2021-34412
- NVD: CVE-2021-34412
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.