Critical severity · published Apr 5, 2022
CVE-2021-33207
The HTTP client in MashZone NextGen through 10.7 GA deserializes untrusted data when it gets an HTTP response with a 570 status code
9.8
CVSS
1.6%
EPSS
No
On KEV
Description
The HTTP client in MashZone NextGen through 10.7 GA deserializes untrusted data when it gets an HTTP response with a 570 status code.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MN
Mashzone Nextgen · Softwareag
through 10.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-33207
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-33207
Third Party Advisory
https://github.com/blackarrowsec/advisories/tree/master/2021/CVE-2021-33207
Vendor Advisory
https://www.softwareag.com/corporate/products/az/mashzone_nextgen/default
More from Mashzone Nextgen
7.2
CVE-2021-33523
MashZone NextGen through 10.7 GA allows a remote authenticated user, with access to the admin console, to upload a new JDBC driver that can execute arbitrary commands on the…
7.2
CVE-2021-33581
MashZone NextGen through 10.7 GA has an SSRF vulnerability that allows an attacker to interact with arbitrary TCP services, by abusing the feature to check the availability of a…
7.2
CVE-2021-33208
The "Register an Ehcache Configuration File" admin feature in MashZone NextGen through 10.7 GA allows XXE attacks via a malicious XML configuration file