CVE-2021-32961
High
Description
A getfile function in MDT AutoSave versions prior to v6.02.06 enables a user to supply an optional parameter, resulting in the processing of a request in a special manner. This can result in the execution of an unzip command and place a malicious .exe file in one of the locations the function looks for and get execution capabilities.
SeverityHigh
CVSS7.5
Exploit probability—
ProductAuvesy-mdt Autosave
PublishedApr 1, 2022
First seenApr 1, 2022
Weakness typeCWE-434Unrestricted upload of dangerous file type
How to fix
Update
- auvesy-mdt autosave6.02.06 or later
- auvesy-mdt autosave_for_system_platform4.01 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| auvesy-mdt autosave | v < 6.02.06, 7.00 ≤ v ≤ 7.04 | 6.02.06 |
| auvesy-mdt autosave_for_system_platform | v < 4.01, 5.00 | 4.01 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.