CVE-2021-32937

Published: Apr 1, 2022Modified: Nov 21, 2024

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

An attacker can gain knowledge of a session temporary working folder where the getfile and putfile commands are used in MDT AutoSave versions prior to v6.02.06. An attacker can leverage this knowledge to provide a malicious command to the working directory where the read and write activity can be initiated.

Affected (4)

Products: Auvesy Mdt: Autosave, Autosave For System Platform

Auvesy Mdt

2 products

Autosave

Autosave For System Platform

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Auvesy Mdt Autosave	Before 6.02.06
Auvesy Mdt Autosave	From 7.00 to 7.04
Auvesy Mdt Autosave For System Platform	Before 4.01
Auvesy Mdt Autosave For System Platform	Version 5.00

Related CWEs

CWE-209

Generation of Error Message Containing Sensitive Information

The product generates an error message that includes sensitive information about its environment, users, or associated data.

References (2)

https://www.cisa.gov/uscert/ics/advisories/icsa-21-189-02

Source: ics-cert@hq.dhs.gov

Third Party AdvisoryUS Government Resource

https://www.cisa.gov/uscert/ics/advisories/icsa-21-189-02

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

Timeline

No history available yet.