PT-2022-12474 · Nginx+2 · Nginx+2
CVE-2021-45967
·
Published
2022-03-18
·
Updated
2024-03-06
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Pascom Cloud Phone System versions prior to 7.20.x
Description
A configuration error between NGINX and a backend Tomcat server leads to a path traversal in the Tomcat server, exposing unintended endpoints.
Recommendations
For versions prior to 7.20.x, update to version 7.20.x or later to resolve the issue. As a temporary workaround, consider restricting access to the Tomcat server to minimize the risk of exploitation.
Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Nginx
Pascom Cloud Phone System
Apache Tomcat