{"id":"CVE-2021-45967","details":"An issue was discovered in Pascom Cloud Phone System before 7.20.x. A configuration error between NGINX and a backend Tomcat server leads to a path traversal in the Tomcat server, exposing unintended endpoints.","aliases":["BIT-openfire-2021-45967"],"modified":"2026-07-09T00:38:20.085894Z","published":"2022-03-18T05:15:07.027Z","database_specific":{"unresolved_ranges":[{"vendor_product":"pascom:cloud_phone_system","cpes":["cpe:2.3:a:pascom:cloud_phone_system:*:*:*:*:*:*:*:*"],"extracted_events":[{"last_affected":"7.19"}],"source":"CPE_RANGE"}]},"references":[{"type":"ADVISORY","url":"https://www.pascom.net/doc/en/release-notes/"},{"type":"ADVISORY","url":"https://www.pascom.net/doc/en/release-notes/pascom19/"},{"type":"FIX","url":"https://kerbit.io/research/read/blog/4"},{"type":"FIX","url":"https://tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-that-lead-to.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/igniterealtime/openfire","events":[{"introduced":"0"},{"fixed":"5b55500c24f27f2296dc80cba2765f13cdf6d5d3"},{"introduced":"5b55500c24f27f2296dc80cba2765f13cdf6d5d3"},{"last_affected":"5b55500c24f27f2296dc80cba2765f13cdf6d5d3"}],"database_specific":{"cpe":["cpe:2.3:a:igniterealtime:openfire:*:*:*:*:*:*:*:*","cpe:2.3:a:igniterealtime:openfire:4.5.0:-:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0"},{"fixed":"4.5.0"},{"introduced":"4.5.0-NA"},{"last_affected":"4.5.0-NA"}],"source":["CPE_RANGE","CPE_STRING"]}}],"versions":["4.5.0-NA","v4.5.0","v4.5.0beta","v4.4.0","v4.4.0beta","v4.3.0","v4.3.0beta","v4.2.0","v4.2.0beta","v4.1.0","v4.1.0beta","v4.0.0","v4.0.0.beta","v3.9.3","v3.9.2","attic/trunk","attic/origin/master"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-45967.json","vanir_signatures_modified":"2026-07-09T00:38:20Z","vanir_signatures":[{"target":{"file":"xmppserver/src/main/java/org/jivesoftware/openfire/spi/XMPPServerInfoImpl.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["262761432185134833165156621220542558562","225611764877731815376785831951323045667","294691526065017774087870060234093953415","280265933700753414683504465090058065902"]},"id":"CVE-2021-45967-a9328a60","signature_type":"Line","signature_version":"v1","source":"https://github.com/igniterealtime/openfire/commit/5b55500c24f27f2296dc80cba2765f13cdf6d5d3"}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}