CVE-2021-32937: MDT Software MDT AutoSave, изтичане на данни

Описание

Оригинално описание

An attacker can gain knowledge of a session temporary working folder where the getfile and putfile commands are used in MDT AutoSave versions prior to v6.02.06. An attacker can leverage this knowledge to provide a malicious command to the working directory where the read and write activity can be initiated.

Засегнати продукти

• MDT Software MDT AutoSave: unspecified преди 6.02.06
• MDT Software MDT AutoSave: 7.00 преди 7.04
• MDT Software AutoSave for System Platform (A4SP): unspecified преди 4.01
• MDT Software A4SP: 5.00

Вид слабост

• CWE-209 Съобщения за грешка с чувствителна информация

История

Други уязвимости в MDT Software MDT AutoSave

• 7.5CVE-2021-32945
• 7.5CVE-2021-32949
• 7.5CVE-2021-32957
• 10.0CVE-2021-32933
• 9.8CVE-2021-32953

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2021-32937
• https://nvd.nist.gov/vuln/detail/CVE-2021-32937
• https://www.cisa.gov/uscert/ics/advisories/icsa-21-189-02