CVE-2021-45024
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk59th percentile - higher than 59% of all known CVEs
Summary
An XML External Entity (XXE) vulnerability in ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 by ASG Technologies (a Rocket Software Company) allows an attacker to read server files or perform SSRF attacks by processing a malicious XML document.
Risk Assessment
The risk involves potential disclosure of sensitive data stored on the server, such as configuration files or credentials, which could lead to privilege escalation or further attacks on the infrastructure.
Recommendation
It is recommended to immediately upgrade to the latest version of ASG-Zena Cross Platform Server that includes a fix for the XXE vulnerability, and to implement secure XML processing practices.
Other vulnerabilities in ASG-Zena Cross Platform Server
See all- CVE-2021-45026Medium
ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to Cross Site Scripting (XSS), allowing injection of malicious scripts.
- CVE-2021-45025High
The vulnerability in ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 involves storing sensitive information in cleartext within a cookie. An attacker can intercept this cookie and gain access to confidential data.
Original NVD description (English source)
ASG technologies ( A Rocket Software Company) ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to XML External Entity (XXE).