Lucene search

IcscertCVELIST:CVE-2021-32957

HistoryApr 01, 2022 - 10:17 p.m.

CVE-2021-32957 MDT AutoSave Uncontrolled Search Path Element

2022-04-0122:17:08

CWE-89

icscert

www.cve.org

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

30.9%

JSON

A function in MDT AutoSave versions prior to v6.02.06 is used to retrieve system information for a specific process, and this information collection executes multiple commands and summarizes the information into an XML. This function and subsequent process gives full path to the executable and is therefore vulnerable to binary hijacking.

CNA Affected

[
  {
    "product": "MDT AutoSave",
    "vendor": "MDT Software",
    "versions": [
      {
        "lessThan": "6.02.06",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "MDT AutoSave",
    "vendor": "MDT Software",
    "versions": [
      {
        "lessThan": "7.04",
        "status": "affected",
        "version": "7.00",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "AutoSave for System Platform (A4SP)",
    "vendor": "MDT Software",
    "versions": [
      {
        "lessThan": "4.01",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "A4SP",
    "vendor": "MDT Software",
    "versions": [
      {
        "status": "affected",
        "version": "5.00"
      }
    ]
  }
]

References

www.cisa.gov/uscert/ics/advisories/icsa-21-189-02

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

30.9%

JSON

Related for CVELIST:CVE-2021-32957