CVE-2021-32933 MDT AutoSave Command Injection
An attacker can execute arbitrary commands by passing a malicious file to the API, impacting MDT AutoSave users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-32933?
CVE-2021-32933 is a critical command injection vulnerability in MDT Software A4SP, published on 1 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An attacker could leverage an API to pass along a malicious file that could then manipulate the process creation command line in MDT AutoSave versions prior to v6.02.06 and run a command line argument. This could then be leveraged to run a malicious process.
Which versions are affected by CVE-2021-32933?
It affects 2 products.
Products include Auvesy-Mdt Autosave, Auvesy-Mdt Autosave for System Platform.
How do I fix CVE-2021-32933?
No fix has been published for CVE-2021-32933 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2021-32933 being exploited?
There is no known exploitation of CVE-2021-32933 in the wild and no public exploit code.
Other vulnerabilities in MDT Software A4SP
- CVE-2021-32953 MDT AutoSave SQL Injection
- CVE-2021-32937 MDT AutoSave Generation of Error Message Containing Sensitive Information
- CVE-2021-32945 MDT AutoSave Inadequate Encryption Strength
- CVE-2021-32949 MDT AutoSave Relative Path Traversal
- CVE-2021-32957 MDT AutoSave Uncontrolled Search Path Element
Sources
Also known as GHSA-98rg-95r3-8mjw.