CVE-2021-32957 MDT AutoSave Uncontrolled Search Path Element

What is CVE-2021-32957?

CVE-2021-32957 is a high-severity path traversal vulnerability in MDT Software A4SP, published on 1 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A function in MDT AutoSave versions prior to v6.02.06 is used to retrieve system information for a specific process, and this information collection executes multiple commands and summarizes the information into an XML. This function and subsequent process gives full path to the executable and is therefore vulnerable to binary hijacking.

Weakness: CWE-89

Which versions are affected by CVE-2021-32957?

It affects 2 products.

Products include Auvesy-Mdt Autosave, Auvesy-Mdt Autosave for System Platform.

How do I fix CVE-2021-32957?

No fix has been published for CVE-2021-32957 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2021-32957 being exploited?

There is no known exploitation of CVE-2021-32957 in the wild and no public exploit code.

Other vulnerabilities in MDT Software A4SP

• CVE-2021-32933 MDT AutoSave Command Injection Critical 10.0
• CVE-2021-32953 MDT AutoSave SQL Injection Critical 9.8
• CVE-2021-32937 MDT AutoSave Generation of Error Message Containing Sensitive Information High 7.5
• CVE-2021-32945 MDT AutoSave Inadequate Encryption Strength High 7.5
• CVE-2021-32949 MDT AutoSave Relative Path Traversal High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-hp9f-q9f5-cghf.