CVE-2021-34419 HTML injection in Zoom Linux client
HTML injection in Zoom Linux client allows attackers to target meeting participants with social engineering attacks during screen sharing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-34419?
CVE-2021-34419 is a low-severity cross-site scripting vulnerability in Zoom Client for Meetings for Ubuntu Linux, published on 11 Nov 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Zoom Client for Meetings for Ubuntu Linux before version 5.1.0, there is an HTML injection flaw when sending a remote control request to a user in the process of in-meeting screen sharing. This could allow meeting participants to be targeted for social engineering attacks.
Weakness: CWE-74
Which versions are affected by CVE-2021-34419?
It affects 1 product.
Products include Zoom Zoom Client for Meetings.
How do I fix CVE-2021-34419?
No fix has been published for CVE-2021-34419 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-34419 being exploited?
There is no known exploitation of CVE-2021-34419 in the wild and no public exploit code.
Other vulnerabilities in Zoom Client for Meetings for Ubuntu Linux
Sources
Also known as GHSA-484c-hxgg-w2g4.