Vulnerabilites related to pascom - cloud_phone_system
CVE-2021-45967 (GCVE-0-2021-45967)
Vulnerability from cvelistv5
Published
2022-03-18 05:00
Modified
2024-11-20 15:41
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
An issue was discovered in Pascom Cloud Phone System before 7.20.x. A configuration error between NGINX and a backend Tomcat server leads to a path traversal in the Tomcat server, exposing unintended endpoints.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.pascom.net/doc/en/release-notes/ | x_refsource_MISC | |
| https://www.pascom.net/doc/en/release-notes/pascom19/ | x_refsource_MISC | |
| https://kerbit.io/research/read/blog/4 | x_refsource_MISC | |
| https://tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-that-lead-to.html | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T04:54:31.217Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.pascom.net/doc/en/release-notes/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.pascom.net/doc/en/release-notes/pascom19/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://kerbit.io/research/read/blog/4"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-that-lead-to.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-45967",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-20T15:41:38.575775Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-20T15:41:51.676Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in Pascom Cloud Phone System before 7.20.x. A configuration error between NGINX and a backend Tomcat server leads to a path traversal in the Tomcat server, exposing unintended endpoints."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-03-18T05:00:35",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.pascom.net/doc/en/release-notes/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.pascom.net/doc/en/release-notes/pascom19/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://kerbit.io/research/read/blog/4"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-that-lead-to.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-45967",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in Pascom Cloud Phone System before 7.20.x. A configuration error between NGINX and a backend Tomcat server leads to a path traversal in the Tomcat server, exposing unintended endpoints."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.pascom.net/doc/en/release-notes/",
"refsource": "MISC",
"url": "https://www.pascom.net/doc/en/release-notes/"
},
{
"name": "https://www.pascom.net/doc/en/release-notes/pascom19/",
"refsource": "MISC",
"url": "https://www.pascom.net/doc/en/release-notes/pascom19/"
},
{
"name": "https://kerbit.io/research/read/blog/4",
"refsource": "MISC",
"url": "https://kerbit.io/research/read/blog/4"
},
{
"name": "https://tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-that-lead-to.html",
"refsource": "MISC",
"url": "https://tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-that-lead-to.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-45967",
"datePublished": "2022-03-18T05:00:35",
"dateReserved": "2022-01-01T00:00:00",
"dateUpdated": "2024-11-20T15:41:51.676Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-45968 (GCVE-0-2021-45968)
Vulnerability from cvelistv5
Published
2022-03-18 04:56
Modified
2024-08-04 04:54
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
An issue was discovered in xmppserver jar in the XMPP Server component of the JIve platform, as used in Pascom Cloud Phone System before 7.20.x (and in other products). An endpoint in the backend Tomcat server of the Pascom allows SSRF, a related issue to CVE-2019-18394.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.pascom.net/doc/en/release-notes/ | x_refsource_MISC | |
| https://jivesoftware.com/platform/ | x_refsource_MISC | |
| https://www.pascom.net/doc/en/release-notes/pascom19/ | x_refsource_MISC | |
| https://kerbit.io/research/read/blog/4 | x_refsource_MISC | |
| https://tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-that-lead-to.html | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T04:54:31.067Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.pascom.net/doc/en/release-notes/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://jivesoftware.com/platform/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.pascom.net/doc/en/release-notes/pascom19/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://kerbit.io/research/read/blog/4"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-that-lead-to.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in xmppserver jar in the XMPP Server component of the JIve platform, as used in Pascom Cloud Phone System before 7.20.x (and in other products). An endpoint in the backend Tomcat server of the Pascom allows SSRF, a related issue to CVE-2019-18394."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-03-18T04:56:37",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.pascom.net/doc/en/release-notes/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://jivesoftware.com/platform/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.pascom.net/doc/en/release-notes/pascom19/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://kerbit.io/research/read/blog/4"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-that-lead-to.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-45968",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in xmppserver jar in the XMPP Server component of the JIve platform, as used in Pascom Cloud Phone System before 7.20.x (and in other products). An endpoint in the backend Tomcat server of the Pascom allows SSRF, a related issue to CVE-2019-18394."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.pascom.net/doc/en/release-notes/",
"refsource": "MISC",
"url": "https://www.pascom.net/doc/en/release-notes/"
},
{
"name": "https://jivesoftware.com/platform/",
"refsource": "MISC",
"url": "https://jivesoftware.com/platform/"
},
{
"name": "https://www.pascom.net/doc/en/release-notes/pascom19/",
"refsource": "MISC",
"url": "https://www.pascom.net/doc/en/release-notes/pascom19/"
},
{
"name": "https://kerbit.io/research/read/blog/4",
"refsource": "MISC",
"url": "https://kerbit.io/research/read/blog/4"
},
{
"name": "https://tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-that-lead-to.html",
"refsource": "MISC",
"url": "https://tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-that-lead-to.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-45968",
"datePublished": "2022-03-18T04:56:37",
"dateReserved": "2022-01-01T00:00:00",
"dateUpdated": "2024-08-04T04:54:31.067Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-45966 (GCVE-0-2021-45966)
Vulnerability from cvelistv5
Published
2022-03-18 05:00
Modified
2024-08-04 04:54
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
An issue was discovered in Pascom Cloud Phone System before 7.20.x. In the management REST API, /services/apply in exd.pl allows remote attackers to execute arbitrary code via shell metacharacters.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.pascom.net/doc/en/release-notes/ | x_refsource_MISC | |
| https://kerbit.io/research/read/blog/4 | x_refsource_MISC | |
| https://tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-that-lead-to.html | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T04:54:31.055Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.pascom.net/doc/en/release-notes/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://kerbit.io/research/read/blog/4"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-that-lead-to.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in Pascom Cloud Phone System before 7.20.x. In the management REST API, /services/apply in exd.pl allows remote attackers to execute arbitrary code via shell metacharacters."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-03-18T05:00:09",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.pascom.net/doc/en/release-notes/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://kerbit.io/research/read/blog/4"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-that-lead-to.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-45966",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in Pascom Cloud Phone System before 7.20.x. In the management REST API, /services/apply in exd.pl allows remote attackers to execute arbitrary code via shell metacharacters."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.pascom.net/doc/en/release-notes/",
"refsource": "MISC",
"url": "https://www.pascom.net/doc/en/release-notes/"
},
{
"name": "https://kerbit.io/research/read/blog/4",
"refsource": "MISC",
"url": "https://kerbit.io/research/read/blog/4"
},
{
"name": "https://tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-that-lead-to.html",
"refsource": "MISC",
"url": "https://tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-that-lead-to.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-45966",
"datePublished": "2022-03-18T05:00:09",
"dateReserved": "2022-01-01T00:00:00",
"dateUpdated": "2024-08-04T04:54:31.055Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Vulnerability from fkie_nvd
Published
2022-03-18 05:15
Modified
2024-11-21 06:33
Severity ?
Summary
An issue was discovered in Pascom Cloud Phone System before 7.20.x. In the management REST API, /services/apply in exd.pl allows remote attackers to execute arbitrary code via shell metacharacters.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://kerbit.io/research/read/blog/4 | Exploit, Third Party Advisory | |
| cve@mitre.org | https://tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-that-lead-to.html | Exploit, Third Party Advisory | |
| cve@mitre.org | https://www.pascom.net/doc/en/release-notes/ | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://kerbit.io/research/read/blog/4 | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-that-lead-to.html | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.pascom.net/doc/en/release-notes/ | Release Notes, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| pascom | cloud_phone_system | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:pascom:cloud_phone_system:*:*:*:*:*:*:*:*",
"matchCriteriaId": "78D2A6F1-C247-4A95-991B-610CDB0DB305",
"versionEndIncluding": "7.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in Pascom Cloud Phone System before 7.20.x. In the management REST API, /services/apply in exd.pl allows remote attackers to execute arbitrary code via shell metacharacters."
},
{
"lang": "es",
"value": "Se ha detectado un problema en Pascom Cloud Phone System versiones anteriores a 7.20.x. En la API REST de administraci\u00f3n, /services/apply en el archivo exd.pl permite a atacantes remotos ejecutar c\u00f3digo arbitrario por medio de metacaracteres de shell"
}
],
"id": "CVE-2021-45966",
"lastModified": "2024-11-21T06:33:23.443",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-03-18T05:15:06.887",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://kerbit.io/research/read/blog/4"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-that-lead-to.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://www.pascom.net/doc/en/release-notes/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://kerbit.io/research/read/blog/4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-that-lead-to.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://www.pascom.net/doc/en/release-notes/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-78"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-03-18 05:15
Modified
2024-11-21 06:33
Severity ?
Summary
An issue was discovered in xmppserver jar in the XMPP Server component of the JIve platform, as used in Pascom Cloud Phone System before 7.20.x (and in other products). An endpoint in the backend Tomcat server of the Pascom allows SSRF, a related issue to CVE-2019-18394.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| jivesoftware | jive | - | |
| pascom | cloud_phone_system | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:jivesoftware:jive:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A902A8C8-B845-4641-8A9E-46543F0190A5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:pascom:cloud_phone_system:*:*:*:*:*:*:*:*",
"matchCriteriaId": "78D2A6F1-C247-4A95-991B-610CDB0DB305",
"versionEndIncluding": "7.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in xmppserver jar in the XMPP Server component of the JIve platform, as used in Pascom Cloud Phone System before 7.20.x (and in other products). An endpoint in the backend Tomcat server of the Pascom allows SSRF, a related issue to CVE-2019-18394."
},
{
"lang": "es",
"value": "Se ha detectado un problema en xmppserver jar en el componente XMPP Server de la plataforma JIve, tal como es usado en Pascom Cloud Phone System versiones anteriores a 7.20.x (y en otros productos). Un endpoint en el servidor Tomcat backend de Pascom permite una vulnerabilidad de tipo SSRF, un problema relacionado con CVE-2019-18394"
}
],
"id": "CVE-2021-45968",
"lastModified": "2024-11-21T06:33:23.793",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-03-18T05:15:07.070",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Product",
"Third Party Advisory"
],
"url": "https://jivesoftware.com/platform/"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://kerbit.io/research/read/blog/4"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-that-lead-to.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://www.pascom.net/doc/en/release-notes/"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://www.pascom.net/doc/en/release-notes/pascom19/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Product",
"Third Party Advisory"
],
"url": "https://jivesoftware.com/platform/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://kerbit.io/research/read/blog/4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-that-lead-to.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://www.pascom.net/doc/en/release-notes/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://www.pascom.net/doc/en/release-notes/pascom19/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-918"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-03-18 05:15
Modified
2024-11-21 06:33
Severity ?
Summary
An issue was discovered in Pascom Cloud Phone System before 7.20.x. A configuration error between NGINX and a backend Tomcat server leads to a path traversal in the Tomcat server, exposing unintended endpoints.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://kerbit.io/research/read/blog/4 | Exploit, Patch, Third Party Advisory | |
| cve@mitre.org | https://tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-that-lead-to.html | Exploit, Patch, Third Party Advisory | |
| cve@mitre.org | https://www.pascom.net/doc/en/release-notes/ | Release Notes, Vendor Advisory | |
| cve@mitre.org | https://www.pascom.net/doc/en/release-notes/pascom19/ | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://kerbit.io/research/read/blog/4 | Exploit, Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-that-lead-to.html | Exploit, Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.pascom.net/doc/en/release-notes/ | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.pascom.net/doc/en/release-notes/pascom19/ | Release Notes, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| pascom | cloud_phone_system | * | |
| igniterealtime | openfire | * | |
| igniterealtime | openfire | 4.5.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:pascom:cloud_phone_system:*:*:*:*:*:*:*:*",
"matchCriteriaId": "78D2A6F1-C247-4A95-991B-610CDB0DB305",
"versionEndIncluding": "7.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:igniterealtime:openfire:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FDF925B6-5EA0-492A-8CA8-A4D7D981641B",
"versionEndExcluding": "4.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:igniterealtime:openfire:4.5.0:-:*:*:*:*:*:*",
"matchCriteriaId": "C09684FF-1F40-443F-AE09-AA26A28BA86D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in Pascom Cloud Phone System before 7.20.x. A configuration error between NGINX and a backend Tomcat server leads to a path traversal in the Tomcat server, exposing unintended endpoints."
},
{
"lang": "es",
"value": "Se ha detectado un problema en Pascom Cloud Phone System versiones anteriores a 7.20.x. Un error de configuraci\u00f3n entre NGINX y un servidor Tomcat backend conlleva a un salto de ruta en el servidor Tomcat, exponiendo endpoints no deseados"
}
],
"id": "CVE-2021-45967",
"lastModified": "2024-11-21T06:33:23.640",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-03-18T05:15:07.027",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch",
"Third Party Advisory"
],
"url": "https://kerbit.io/research/read/blog/4"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch",
"Third Party Advisory"
],
"url": "https://tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-that-lead-to.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://www.pascom.net/doc/en/release-notes/"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://www.pascom.net/doc/en/release-notes/pascom19/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch",
"Third Party Advisory"
],
"url": "https://kerbit.io/research/read/blog/4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch",
"Third Party Advisory"
],
"url": "https://tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-that-lead-to.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://www.pascom.net/doc/en/release-notes/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://www.pascom.net/doc/en/release-notes/pascom19/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}