CVE-2021-33581

HIGH

MashZone NextGen < 10.7 - Server-Side Request Forgery via PPM Connection Availability Check

Title source: llm
STIX 2.1

Description

MashZone NextGen through 10.7 GA has an SSRF vulnerability that allows an attacker to interact with arbitrary TCP services, by abusing the feature to check the availability of a PPM connection. This occurs in com.idsscheer.ppmmashup.web.webservice.impl.ZPrestoAdminWebService.

References (2)

Core 2

Scores

CVSS v3 7.2
EPSS 0.0123
EPSS Percentile 65.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-918
Status published
Products (1)
softwareag/mashzone_nextgen < 10.7
Published Mar 30, 2022
Tracked Since Feb 18, 2026