PT-2022-10218 · Unknown · Mashzone Nextgen

Marcos Díaz · Published 2022-04-05 · Updated 2022-04-13 · CVE-2021-33207

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MashZone NextGen versions through 10.7 GA

Description The issue concerns the HTTP client in MashZone NextGen, which deserializes untrusted data when it receives an HTTP response with a specific status code, 570.

Recommendations For MashZone NextGen versions through 10.7 GA, update to a version that includes a fix for this issue to prevent the deserialization of untrusted data.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2021-33207

Affected Products

Mashzone Nextgen

References · 4

• 🔥 https://github.com/blackarrowsec/advisories/tree/master/2021/CVE-2021-33207 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-33207 · Security Note
• https://osv.dev/vulnerability/CVE-2021-33207 · Vendor Advisory
• https://softwareag.com/corporate/products/az/mashzone_nextgen/default · Vendor Advisory