Communications Element Manager

Vendor:

First CVE: Aug 2, 2018 · Active for 7 years

68

Total CVEs

More Total CVEs than 98% of tracked products

13.6

Avg CVEs / Year

Higher CVE frequency than 97% of tracked products

7.5

Avg CVSS

Higher Avg CVSS than 59% of tracked products

2.9%

KEV Rate

Higher KEV Rate than 97% of tracked products

Trends Over Time

The number and severity of CVEs published that impact Communications Element Manager over time

Volume of CVEsAvg CVSS Base Score

First CVE

Aug 2, 2018

7 years ago

Most Recent CVE

Jan 24, 2022

1,643 days ago

CVE Severity & Scoring

Communications Element Manager68 CVEs

22%

65%

10%

All CVEs352,708 CVEs

45%

40%

11%

LowMediumHighCritical

Attack Vector

Local3 (4.4%)

Network62 (91.2%)

Unknown0 (0.0%)

Physical1 (1.5%)

Adjacent Network2 (2.9%)

Attack Complexity

Low44 (64.7%)

High24 (35.3%)

Unknown0 (0.0%)

User Interaction

None52 (76.5%)

Unknown0 (0.0%)

Required16 (23.5%)

Privileges Required

Low4 (5.9%)

High2 (2.9%)

None62 (91.2%)

Unknown0 (0.0%)

Top CVEs

Signals from CVEs in this product scope (68 CVEs).

68 CVEs · Highest risk first

CVE	Published	CVSS	Risk	KEV	Exploit
CVE-2020-1938CRITICAL When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for e	Feb 24, 2020	9.8	99	YES	YES
CVE-2020-11023MEDIUM In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's	Apr 29, 2020	6.1	95	YES	YES
CVE-2021-44790CRITICAL A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an explo	Dec 20, 2021	9.8	88	NO	YES
CVE-2019-0227HIGH A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projec	May 1, 2019	7.5	84	NO	YES
CVE-2020-11984CRITICAL Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE	Aug 7, 2020	9.8	83	NO	YES
CVE-2019-10092MEDIUM In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the link on the error page to be m	Sep 26, 2019	6.1	82	NO	YES
CVE-2019-11358MEDIUM jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source ob	Apr 20, 2019	6.1	78	NO	YES
CVE-2021-45105MEDIUM Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker wit	Dec 18, 2021	5.9	76	NO	NO
CVE-2020-5398HIGH In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (R	Jan 17, 2020	7.5	73	NO	NO
CVE-2021-44224HIGH A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy de	Dec 20, 2021	8.2	72	NO	NO

View all 68 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (68 CVEs).

CISA KEV

2 CVEs

2.9% of CVEs· 97th percentile

Metasploit

1 CVE

1.5% of CVEs· 96th percentile

Nuclei

5 CVEs

7.4% of CVEs· 97th percentile

ExploitDB

6 CVEs

8.8% of CVEs· 89th percentile

Social Chatter

Signals from CVEs in this product scope (68 CVEs).

Media Mentions

Signals from CVEs in this product scope (68 CVEs).

Top CNAs Publishing CVEs For Communications Element Manager

Top CWEs

Versions

Version	CVE Count	Avg CVSS	Avg EPSS	KEV	Exploits
8.2.2	5	5.7	14.5%	0	0
8.2.1	11	6.4	45.6%	2	3
8.2.0	19	6.6	41.7%	2	5
8.1.1	19	6.6	41.7%	2	5
8.1.0	8	6.8	36.3%	0	2
8.0.0	8	6.8	36.3%	0	2