PT-2021-22791 · Mobility · Mobility

Published 2021-09-16 · Updated 2021-11-29 · CVE-2021-40067

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Mobility versions prior to 12.14

Description The access controls on the Mobility read-write API improperly validate user access permissions. This API is disabled by default, but if manually enabled, attackers with network access to the API and valid credentials can read and write data to it, regardless of access control group membership settings.

Recommendations For versions prior to 12.14, update to Mobility version 12.14 to resolve the issue. As a temporary workaround, consider disabling the Mobility read-write API until the update is applied. Restrict access to the API to minimize the risk of exploitation.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2021-40067

Affected Products

Mobility

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-40067 · Security Note
• https://netmotionsoftware.com/security-advisories/cve-2021-40067 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-40067 · Vendor Advisory
• https://t.me/cibsecurity/28979 · Telegram Post