CVE-2021-32961 MDT AutoSave Unrestricted Upload of File with Dangerous Type

What is CVE-2021-32961?

CVE-2021-32961 is a high-severity vulnerability in MDT Software A4SP, published on 1 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A getfile function in MDT AutoSave versions prior to v6.02.06 enables a user to supply an optional parameter, resulting in the processing of a request in a special manner. This can result in the execution of an unzip command and place a malicious .exe file in one of the locations the function looks for and get execution capabilities.

Weakness: CWE-434

Which versions are affected by CVE-2021-32961?

It affects 2 products.

Products include Auvesy-Mdt Autosave, Auvesy-Mdt Autosave for System Platform.

How do I fix CVE-2021-32961?

No fix has been published for CVE-2021-32961 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-32961 being exploited?

There is no known exploitation of CVE-2021-32961 in the wild and no public exploit code.

Other vulnerabilities in MDT Software A4SP

• CVE-2021-32933 MDT AutoSave Command Injection Critical 10.0
• CVE-2021-32953 MDT AutoSave SQL Injection Critical 9.8
• CVE-2021-32937 MDT AutoSave Generation of Error Message Containing Sensitive Information High 7.5
• CVE-2021-32945 MDT AutoSave Inadequate Encryption Strength High 7.5
• CVE-2021-32949 MDT AutoSave Relative Path Traversal High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-5xp6-vv6v-2vr5.