CVE-2021-34409

Zoom Client Installer Local Privilege Escalation

State: Published
Severity: 7.8 High
Published: Sep 27, 2021
Updated: Sep 16, 2024
Reserved: Jun 9, 2021

Description

It was discovered that the installation packages of the Zoom Client for Meetings for MacOS (Standard and for IT Admin) installation before version 5.2.0, Zoom Client Plugin for Sharing iPhone/iPad before version 5.2.0, and Zoom Rooms for Conference before version 5.1.0, copy pre- and post- installation shell scripts to a user-writable directory. In the affected products listed below, a malicious actor with local access to a user's machine could use this flaw to potentially run arbitrary system commands in a higher privileged context during the installation process.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H	Zoom

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
Zoom Client for Meetings for MacOS (Standard and for IT Admin)Zoom Video Communications Inc	before 5.2.0Affected
Zoom Client Plugin for Sharing iPhone/iPadZoom Video Communications Inc	before 5.2.0Affected
Zoom Rooms for ConferenceZoom Video Communications Inc	before 5.1.0Affected

References

https://explore.zoom.us/en/trust/security/security-bulletin

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.