PT-2021-20211 · Cleo · Cleo Lexicom

Stephen Breen · Published 2021-06-18 · Updated 2021-06-22 · CVE-2021-33576

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cleo LexiCom version 5.5.0.0

Description An issue was discovered in Cleo LexiCom where the sender can specify a filename within the AS2 message. This filename can include path-traversal characters, allowing the file to be written to an arbitrary location on disk.

Recommendations For Cleo LexiCom version 5.5.0.0, as a temporary workaround, consider restricting the ability for senders to specify filenames within AS2 messages until a patch is available. Additionally, restrict access to sensitive directories to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-33576

Affected Products

Cleo Lexicom

References · 8

• 🔥 https://github.com/atredispartners/advisories/blob/master/ATREDIS-2020-0011.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-33576 · Security Note
• https://osv.dev/vulnerability/CVE-2021-33576 · Vendor Advisory
• https://t.me/cvenotify/16683 · Telegram Post
• https://t.me/cvenotify/16545 · Telegram Post
• https://cleo.com/cleo-lexicom · Note
• https://t.me/cibsecurity/25545 · Telegram Post
• https://t.me/cvenotify/16572 · Telegram Post