PT-2021-20212 · Cleo · Cleo Lexicom

Stephen Breen · Published 2021-06-18 · Updated 2022-07-12 · CVE-2021-33577

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cleo LexiCom version 5.5.0.0

Description An issue allows the bypass of the requirement for the sender of an AS2 message to identify themselves via encryption and signing of the message. This can be achieved by changing the Content-Type of the message to text/plain.

Recommendations For Cleo LexiCom version 5.5.0.0, as a temporary workaround, consider restricting changes to the Content-Type of AS2 messages to prevent bypassing sender identification requirements. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Related Identifiers

CVE-2021-33577

Affected Products

Cleo Lexicom

References · 5

• 🔥 https://github.com/atredispartners/advisories/blob/master/ATREDIS-2020-0011.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-33577 · Security Note
• https://osv.dev/vulnerability/CVE-2021-33577 · Vendor Advisory
• https://cleo.com/cleo-lexicom · Note
• https://t.me/cvenotify/16544 · Telegram Post