Lucene search

[email protected]CVE-2023-41137

HistoryNov 09, 2023 - 3:15 p.m.

CVE-2023-41137

2023-11-0915:15:08

CWE-798

CWE-321

[email protected]

web.nvd.nist.gov

cve-2023-41137

symmetric encryption

appsanywhere

vulnerability

nvd

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

26.2%

JSON

Symmetric encryption used to protect messages between the AppsAnywhere server and client can be broken by reverse engineering the client and used to impersonate the AppsAnywhere server.

Affected configurations

NVD

Node

appsanywhereappsanywhere_clientMatch1.4.0windows

appsanywhereappsanywhere_clientMatch1.4.1windows

appsanywhereappsanywhere_clientMatch1.5.1windows

appsanywhereappsanywhere_clientMatch1.6.0windows

appsanywhereappsanywhere_clientMatch2.0.0windows

Node

appsanywhereappsanywhere_clientMatch1.4.0macos

appsanywhereappsanywhere_clientMatch1.4.1macos

appsanywhereappsanywhere_clientMatch1.5.1macos

appsanywhereappsanywhere_clientMatch1.5.2macos

appsanywhereappsanywhere_clientMatch1.6.0macos

appsanywhereappsanywhere_clientMatch2.0.0macos

CPENameOperatorVersion
appsanywhere:appsanywhere_clientappsanywhere appsanywhere clienteq1.4.0
appsanywhere:appsanywhere_clientappsanywhere appsanywhere clienteq1.4.1
appsanywhere:appsanywhere_clientappsanywhere appsanywhere clienteq1.5.1
appsanywhere:appsanywhere_clientappsanywhere appsanywhere clienteq1.6.0
appsanywhere:appsanywhere_clientappsanywhere appsanywhere clienteq2.0.0

CPE	Name	Operator	Version
appsanywhere:appsanywhere_client	appsanywhere appsanywhere client	eq	1.4.0
appsanywhere:appsanywhere_client	appsanywhere appsanywhere client	eq	1.4.1
appsanywhere:appsanywhere_client	appsanywhere appsanywhere client	eq	1.5.1
appsanywhere:appsanywhere_client	appsanywhere appsanywhere client	eq	1.6.0
appsanywhere:appsanywhere_client	appsanywhere appsanywhere client	eq	2.0.0

CNA Affected

[
  {
    "vendor": "AppsAnywhere",
    "product": "AppsAnywhere Client",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "version": "1.4.0",
        "status": "affected"
      },
      {
        "version": "1.4.1",
        "status": "affected"
      },
      {
        "version": "1.5.1",
        "status": "affected"
      },
      {
        "version": "1.5.2",
        "status": "affected"
      },
      {
        "version": "1.6.0",
        "status": "affected"
      },
      {
        "version": "2.0.0",
        "status": "affected"
      },
      {
        "version": "1.6.1",
        "status": "unaffected"
      },
      {
        "version": "2.0.1",
        "status": "unaffected"
      },
      {
        "version": "2.2.0",
        "status": "unaffected"
      }
    ]
  }
]

References

docs.appsanywhere.com/appsanywhere/3.1/2023-11-security-advisory

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

26.2%

JSON

Related for CVE-2023-41137

nvd1 prion1 cvelist1