CVE-2021-45025
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
The vulnerability in ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 involves storing sensitive information in cleartext within a cookie. An attacker can intercept this cookie and gain access to confidential data.
Risk Assessment
The risk involves potential theft of sensitive data such as session tokens or passwords, which could lead to unauthorized system access and data confidentiality breaches.
Recommendation
It is recommended to immediately update to the latest version of ASG-Zena software that fixes this vulnerability. Also configure cookie encryption and use secure flags (e.g., Secure, HttpOnly).
Other vulnerabilities in ASG-Zena Cross Platform Server
See all- CVE-2021-45024Critical
An XML External Entity (XXE) vulnerability in ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 by ASG Technologies (a Rocket Software Company) allows an attacker to read server files or perform SSRF attacks by processing a malicious XML document.
- CVE-2021-45026Medium
ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to Cross Site Scripting (XSS), allowing injection of malicious scripts.
Original NVD description (English source)
ASG technologies ( A Rocket Software Company) ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to Cleartext Storage of Sensitive Information in a Cookie.