CVE-2021-45967

· CRITICALModified

← All CVEs

CVSS v3.1

9.8

EPSS

20.80%

Published

Mar 18, 2022

Modified

Nov 21, 2024

Public PoC / Exploit (2)

All weaponized →

NucleiNuclei detection template TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

An issue was discovered in Pascom Cloud Phone System before 7.20.x. A configuration error between NGINX and a backend Tomcat server leads to a path traversal in the Tomcat server, exposing unintended endpoints.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-22

Affected Products (3)

pascom · cloud_phone_systemvulnerable

igniterealtime · openfire (up to 4.5.0)vulnerable

igniterealtime · openfirevulnerable

References (8)

https://kerbit.io/research/read/blog/4

ExploitPatchThird Party Advisory

https://tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-that-lead-to.html

ExploitPatchThird Party Advisory

https://www.pascom.net/doc/en/release-notes/

Release NotesVendor Advisory

https://www.pascom.net/doc/en/release-notes/pascom19/

Release NotesVendor Advisory

https://kerbit.io/research/read/blog/4

ExploitPatchThird Party Advisory

https://tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-that-lead-to.html

ExploitPatchThird Party Advisory

https://www.pascom.net/doc/en/release-notes/

Release NotesVendor Advisory

https://www.pascom.net/doc/en/release-notes/pascom19/

Release NotesVendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs