PT-2021-22162 · Altova · Altova Mobiletogether Server

Published 2021-08-10 · Updated 2021-08-18 · CVE-2021-38490

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Altova MobileTogether Server versions prior to 7.3 SP1

Description The issue concerns XML exponential entity expansion.

Recommendations For versions prior to 7.3 SP1, update to version 7.3 SP1 or later to resolve the issue.

Fix

XML Entity Expansion

Weakness Enumeration

CWE-776

Related Identifiers

CVE-2021-38490

Affected Products

Altova Mobiletogether Server

References · 4

• https://osv.dev/vulnerability/CVE-2021-38490 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38490 · Security Note
• https://t.me/cvenotify/19026 · Telegram Post
• https://redteam-pentesting.de/advisories/rt-sa-2021-002 · Note