CVE-2021-32937 MDT AutoSave Generation of Error Message Containing Sensitive Information
An attacker can obtain sensitive session folder paths to inject malicious commands, potentially leading to unauthorized code execution in MDT AutoSave.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-32937?
CVE-2021-32937 is a high-severity vulnerability in MDT Software A4SP, published on 1 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An attacker can gain knowledge of a session temporary working folder where the getfile and putfile commands are used in MDT AutoSave versions prior to v6.02.06. An attacker can leverage this knowledge to provide a malicious command to the working directory where the read and write activity can be initiated.
Weakness: CWE-209
Which versions are affected by CVE-2021-32937?
It affects 2 products.
Products include Auvesy-Mdt Autosave, Auvesy-Mdt Autosave for System Platform.
How do I fix CVE-2021-32937?
No fix has been published for CVE-2021-32937 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-32937 being exploited?
There is no known exploitation of CVE-2021-32937 in the wild and no public exploit code.
Other vulnerabilities in MDT Software A4SP
Sources
Also known as GHSA-28ph-8qph-7chx.