CVE-2021-45968

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in xmppserver jar in the XMPP Server component of the JIve platform, as used in Pascom Cloud Phone System before 7.20.x (and in other products). An endpoint in the backend Tomcat server of the Pascom allows SSRF, a related issue to CVE-2019-18394.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://jivesoftware.com/platform/Product, Third Party Advisory
https://kerbit.io/research/read/blog/4Exploit, Third Party Advisory
https://tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-that-lead-to.htmlExploit, Third Party Advisory
https://www.pascom.net/doc/en/release-notes/Release Notes, Vendor Advisory
https://www.pascom.net/doc/en/release-notes/pascom19/Release Notes, Vendor Advisory
https://jivesoftware.com/platform/Product, Third Party Advisory
https://kerbit.io/research/read/blog/4Exploit, Third Party Advisory
https://tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-that-lead-to.htmlExploit, Third Party Advisory
https://www.pascom.net/doc/en/release-notes/Release Notes, Vendor Advisory
https://www.pascom.net/doc/en/release-notes/pascom19/Release Notes, Vendor Advisory

Timeline

Published: Mar 18, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-459698.2An issue was discovered in AhciBusDxe in Insyde InsydeH2O with kernel 5.1 before 05.16.25, 5.2 before 05.26.25, 5.3 before 05.35.25, 5.4 bef CVE-2021-459708.2An issue was discovered in IdeBusDxe in Insyde InsydeH2O with kernel 5.1 before 05.16.25, 5.2 before 05.26.25, 5.3 before 05.35.25, 5.4 befo CVE-2021-459718.2An issue was discovered in SdHostDriver in Insyde InsydeH2O with kernel 5.1 before 05.16.25, 5.2 before 05.26.25, 5.3 before 05.35.25, 5.4 b CVE-2021-459727.1The giftrans function in giftrans 1.12.2 contains a stack-based buffer overflow because a value inside the input file determines the amount CVE-2021-459757.8In ListCheck.exe in Acer Care Center 4.x before 4.00.3038, a vulnerability in the loading mechanism of Windows DLLs could allow a local atta CVE-2021-459779.8JetBrains IntelliJ IDEA 2021.3.1 Preview, IntelliJ IDEA 2021.3.1 RC, PyCharm Professional 2021.3.1 RC, GoLand 2021.3.1, PhpStorm 2021.3.1 Pr CVE-2021-459787.8Foxit PDF Reader and PDF Editor before 11.1 on macOS allow remote attackers to execute arbitrary code via xfa.host.gotoURL in the XFA API.CVE-2021-459797.8Foxit PDF Reader and PDF Editor before 11.1 on macOS allow remote attackers to execute arbitrary code via app.launchURL in the JavaScript AP CVE-2021-459807.8Foxit PDF Reader and PDF Editor before 11.1 on macOS allow remote attackers to execute arbitrary code via getURL in the JavaScript API.CVE-2021-459819.8NetScout nGeniusONE 6.3.2 allows an XML External Entity (XXE) attack.CVE-2021-459828.8NetScout nGeniusONE 6.3.2 allows Arbitrary File Upload by a privileged user.CVE-2021-459839.8NetScout nGeniusONE 6.3.2 allows Java RMI Code Execution.