PT-2022-10154 · Unknown · Mdt Autosave

Amir Preminger · Published 2022-04-01 · Updated 2022-10-25 · CVE-2021-32933

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions MDT AutoSave versions prior to v6.02.06

Description An issue exists where an attacker could leverage an API to pass a malicious file, manipulating the process creation command line and potentially running a command line argument. This could allow the attacker to run a malicious process.

Recommendations For versions prior to v6.02.06, update to version v6.02.06 or later to resolve the issue. As a temporary workaround, consider restricting access to the API endpoint used to pass the malicious file until a patch is applied.

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2021-32933

Affected Products

Mdt Autosave

References · 3

• https://osv.dev/vulnerability/CVE-2021-32933 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32933 · Security Note
• https://cisa.gov/uscert/ics/advisories/icsa-21-189-02 · Note