CVE-2021-32957

Опубликовано: 01 апр. 2022

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

A function in MDT AutoSave versions prior to v6.02.06 is used to retrieve system information for a specific process, and this information collection executes multiple commands and summarizes the information into an XML. This function and subsequent process gives full path to the executable and is therefore vulnerable to binary hijacking.

Ссылки

https://www.cisa.gov/uscert/ics/advisories/icsa-21-189-02
Mitigation
Third Party Advisory
US Government Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-21-189-02
Mitigation
Third Party Advisory
US Government Resource

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:auvesy-mdt:autosave:*:*:*:*:*:*:*:*

Версия до 6.02.06 (исключая)

cpe:2.3:a:auvesy-mdt:autosave:*:*:*:*:*:*:*:*

Версия от 7.00 (включая) до 7.04 (включая)

cpe:2.3:a:auvesy-mdt:autosave_for_system_platform:*:*:*:*:*:*:*:*

Версия до 4.01 (исключая)

cpe:2.3:a:auvesy-mdt:autosave_for_system_platform:5.00:*:*:*:*:*:*:*

EPSS

Процентиль: 39%

0.00173

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-89

Связанные уязвимости

GHSA-hp9f-q9f5-cghf