CVE-2021-45967: Ignite Realtime Openfire

Critical severity, CVSS 9.8. EPSS: 20.8% chance of exploitation in the next 30 days.

An issue was discovered in Pascom Cloud Phone System before 7.20.x. A configuration error between NGINX and a backend Tomcat server leads to a path traversal in the Tomcat server, exposing unintended endpoints.

Affected products

• Ignite Realtime Openfire: before 4.5.0 (fixed in 4.5.0); version 4.5.0 only
• Pascom Cloud Phone System: up to and including 7.19

Published 2022-03-18. Last modified 2026-06-17.