CVE-2021-45024

CriticalCVSS 9.8

Published: 17/06/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.02%

59th percentile - higher than 59% of all known CVEs

Summary

An XML External Entity (XXE) vulnerability in ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 by ASG Technologies (a Rocket Software Company) allows an attacker to read server files or perform SSRF attacks by processing a malicious XML document.

Risk Assessment

The risk involves potential disclosure of sensitive data stored on the server, such as configuration files or credentials, which could lead to privilege escalation or further attacks on the infrastructure.

Recommendation

It is recommended to immediately upgrade to the latest version of ASG-Zena Cross Platform Server that includes a fix for the XXE vulnerability, and to implement secure XML processing practices.

Original NVD description (English source)

ASG technologies ( A Rocket Software Company) ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to XML External Entity (XXE).