CVE-2021-45968

HIGHNuclei

Pascom CPS - Local File Inclusion

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2021-45968 has a selected CVSS score of 7.5 (high); EIP currently links 1 Nuclei template.

Description

An issue was discovered in xmppserver jar in the XMPP Server component of the JIve platform, as used in Pascom Cloud Phone System before 7.20.x (and in other products). An endpoint in the backend Tomcat server of the Pascom allows SSRF, a related issue to CVE-2019-18394.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryHIGHPascom CPS - Local File InclusionCVSS 7.5

Pascom packaged with Cloud Phone System (CPS) versions before 7.20 contain a known local file inclusion vulnerability.

Impact

The vulnerability can be exploited by an attacker to gain unauthorized access to sensitive information, execute arbitrary code, or perform other malicious activities.

Remediation

Apply the latest security patches or updates provided by the vendor to fix the Local File Inclusion vulnerability in Pascom CPS.

WeaknessesCWE-918
Authorsdwisiswant0
Template tagscve2021cvepascomlfijivesoftwarevuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CPE: cpe:2.3:a:jivesoftware:jive:-:*:*:*:*:*:*:*
https://kerbit.io/research/read/blog/4 https://www.pascom.net/doc/en/release-notes/ https://tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-that-lead-to.html https://nvd.nist.gov/vuln/detail/CVE-2021-45968 https://jivesoftware.com/platform/

Source: ProjectDiscovery

References

6