CVE-2021-34410

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A user-writable application bundle unpacked during the install for all versions of the Zoom Plugin for Microsoft Outlook for Mac before 5.0.25611.0521 allows for privilege escalation to root.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-732

Affected software

No affected versions have been published.

Timeline

Published
Sep 27, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-344117.8During the installation process forZoom Rooms for Conference Room for Windows before version 5.3.0 it is possible to launch Internet ExploreCVE-2021-344127.8During the installation process for all versions of the Zoom Client for Meetings for Windows before 5.4.0, it is possible to launch InternetCVE-2021-344137.5All versions of the Zoom Plugin for Microsoft Outlook for MacOS before 5.3.52553.0918 contain a Time-of-check Time-of-use (TOC/TOU) vulnerabCVE-2021-344147.2The network proxy page on the web portal for the Zoom on-premise Meeting Connector Controller before version 4.6.348.20201217, Zoom on-premiCVE-2021-344157.5The Zone Controller service in the Zoom On-Premise Meeting Connector Controller before version 4.6.358.20210205 does not verify the cnt fielCVE-2021-344169.8The network address administrative settings web portal for the Zoom on-premise Meeting Connector before version 4.6.360.20210325, Zoom on-prCVE-2021-344177.2The network proxy page on the web portal for the Zoom On-Premise Meeting Connector Controller before version 4.6.365.20210703, Zoom On-PremiCVE-2021-344185.3The login routine of the web console in the Zoom On-Premise Meeting Connector before version 4.6.239.20200613, Zoom On-Premise Meeting ConneCVE-2021-344195.3In the Zoom Client for Meetings for Ubuntu Linux before version 5.1.0, there is an HTML injection flaw when sending a remote control requestCVE-2021-34425.4A flaw was found in the Red Hat OpenShift API Management product. User input is not validated allowing an authenticated user to inject scripCVE-2021-344207.4The Zoom Client for Meetings for Windows installer before version 5.5.4 does not properly verify the signature of files with .msi, .ps1, andCVE-2021-344214.3The Keybase Client for Android before version 5.8.0 and the Keybase Client for iOS before version 5.8.0 fails to properly remove exploded me
CVE-2021-34410: High severity, CVSS 7.8 | Vulnix