CVE-2021-45026
MediumCVSS 6.1Exploitation Probability (EPSS)
Elevated risk62th percentile - higher than 62% of all known CVEs
Summary
ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to Cross Site Scripting (XSS), allowing injection of malicious scripts.
Risk Assessment
An attacker can exploit this vulnerability to steal user sessions, redirect to malicious sites, or steal sensitive data.
Recommendation
It is recommended to update to the latest version of ASG-Zena software and implement input and output filters for user data.
Other vulnerabilities in ASG-Zena Cross Platform Server
See all- CVE-2021-45024Critical
An XML External Entity (XXE) vulnerability in ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 by ASG Technologies (a Rocket Software Company) allows an attacker to read server files or perform SSRF attacks by processing a malicious XML document.
- CVE-2021-45025High
The vulnerability in ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 involves storing sensitive information in cleartext within a cookie. An attacker can intercept this cookie and gain access to confidential data.
Original NVD description (English source)
ASG technologies ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to Cross Site Scripting (XSS).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS