Search criteria
7 vulnerabilities by MDT Software
CVE-2021-32945 (GCVE-0-2021-32945)
Vulnerability from cvelistv5 – Published: 2022-04-01 22:17 – Updated: 2025-04-16 16:33
VLAI?
Title
MDT AutoSave Inadequate Encryption Strength
Summary
An attacker could decipher the encryption and gain access to MDT AutoSave versions prior to v6.02.06.
Severity ?
7.5 (High)
CWE
- CWE-326 - Inadequate Encryption Strength
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| MDT Software | MDT AutoSave |
Affected:
unspecified , < 6.02.06
(custom)
|
|||||||||||||||||
|
|||||||||||||||||||
Credits
Amir Preminger of Claroty Research reported these vulnerabilities to MDT Software.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:33:56.098Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-189-02"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-32945",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-16T15:58:19.788465Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-16T16:33:53.886Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "MDT AutoSave",
"vendor": "MDT Software",
"versions": [
{
"lessThan": "6.02.06",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "MDT AutoSave",
"vendor": "MDT Software",
"versions": [
{
"lessThan": "7.04",
"status": "affected",
"version": "7.00",
"versionType": "custom"
}
]
},
{
"product": "AutoSave for System Platform (A4SP)",
"vendor": "MDT Software",
"versions": [
{
"lessThan": "4.01",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "A4SP",
"vendor": "MDT Software",
"versions": [
{
"status": "affected",
"version": "5.00"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Amir Preminger of Claroty Research reported these vulnerabilities to MDT Software."
}
],
"descriptions": [
{
"lang": "en",
"value": "An attacker could decipher the encryption and gain access to MDT AutoSave versions prior to v6.02.06."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-326",
"description": "CWE-326: Inadequate Encryption Strength",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-04-01T22:17:10.000Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-189-02"
}
],
"solutions": [
{
"lang": "en",
"value": "Updated versions of MDT AutoSave and AutoSave for System Platform (A4SP) were developed to address these vulnerabilities as follows:\nMDT AutoSave 6.x version: Version 6.02.06 (Released January 2021)\nMDT AutoSave 7.x version: Version 7.05 (Released December 2020)\nA4SP 4.x version: Version 4.01 (Released June 2021)\nA4SP 5.x version: Version 5.01 (Released May 2021)\n\nFor more information about these vulnerabilities, and to obtain and install the new versions, please contact MDT Software customer support."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "MDT AutoSave Inadequate Encryption Strength",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"ID": "CVE-2021-32945",
"STATE": "PUBLIC",
"TITLE": "MDT AutoSave Inadequate Encryption Strength"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "MDT AutoSave",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "6.02.06"
}
]
}
},
{
"product_name": "MDT AutoSave",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "7.00",
"version_value": "7.04"
}
]
}
},
{
"product_name": "AutoSave for System Platform (A4SP)",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "4.01"
}
]
}
},
{
"product_name": "A4SP",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "5.00"
}
]
}
}
]
},
"vendor_name": "MDT Software"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Amir Preminger of Claroty Research reported these vulnerabilities to MDT Software."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An attacker could decipher the encryption and gain access to MDT AutoSave versions prior to v6.02.06."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-326: Inadequate Encryption Strength"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-189-02",
"refsource": "CONFIRM",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-189-02"
}
]
},
"solution": [
{
"lang": "en",
"value": "Updated versions of MDT AutoSave and AutoSave for System Platform (A4SP) were developed to address these vulnerabilities as follows:\nMDT AutoSave 6.x version: Version 6.02.06 (Released January 2021)\nMDT AutoSave 7.x version: Version 7.05 (Released December 2020)\nA4SP 4.x version: Version 4.01 (Released June 2021)\nA4SP 5.x version: Version 5.01 (Released May 2021)\n\nFor more information about these vulnerabilities, and to obtain and install the new versions, please contact MDT Software customer support."
}
],
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2021-32945",
"datePublished": "2022-04-01T22:17:10.000Z",
"dateReserved": "2021-05-13T00:00:00.000Z",
"dateUpdated": "2025-04-16T16:33:53.886Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-32949 (GCVE-0-2021-32949)
Vulnerability from cvelistv5 – Published: 2022-04-01 22:17 – Updated: 2025-04-16 16:34
VLAI?
Title
MDT AutoSave Relative Path Traversal
Summary
An attacker could utilize a function in MDT AutoSave versions prior to v6.02.06 that permits changing a designated path to another path and traversing the directory, allowing the replacement of an existing file with a malicious file.
Severity ?
7.5 (High)
CWE
- CWE-23 - Relative Path Traversal
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| MDT Software | MDT AutoSave |
Affected:
unspecified , < 6.02.06
(custom)
|
|||||||||||||||||
|
|||||||||||||||||||
Credits
Amir Preminger of Claroty Research reported these vulnerabilities to MDT Software.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:33:56.227Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-189-02"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-32949",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-16T15:58:23.231933Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-16T16:34:03.231Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "MDT AutoSave",
"vendor": "MDT Software",
"versions": [
{
"lessThan": "6.02.06",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "MDT AutoSave",
"vendor": "MDT Software",
"versions": [
{
"lessThan": "7.04",
"status": "affected",
"version": "7.00",
"versionType": "custom"
}
]
},
{
"product": "AutoSave for System Platform (A4SP)",
"vendor": "MDT Software",
"versions": [
{
"lessThan": "4.01",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "A4SP",
"vendor": "MDT Software",
"versions": [
{
"status": "affected",
"version": "5.00"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Amir Preminger of Claroty Research reported these vulnerabilities to MDT Software."
}
],
"descriptions": [
{
"lang": "en",
"value": "An attacker could utilize a function in MDT AutoSave versions prior to v6.02.06 that permits changing a designated path to another path and traversing the directory, allowing the replacement of an existing file with a malicious file."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-23",
"description": "CWE-23: Relative Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-04-01T22:17:09.000Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-189-02"
}
],
"solutions": [
{
"lang": "en",
"value": "Updated versions of MDT AutoSave and AutoSave for System Platform (A4SP) were developed to address these vulnerabilities as follows:\nMDT AutoSave 6.x version: Version 6.02.06 (Released January 2021)\nMDT AutoSave 7.x version: Version 7.05 (Released December 2020)\nA4SP 4.x version: Version 4.01 (Released June 2021)\nA4SP 5.x version: Version 5.01 (Released May 2021)\n\nFor more information about these vulnerabilities, and to obtain and install the new versions, please contact MDT Software customer support."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "MDT AutoSave Relative Path Traversal",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"ID": "CVE-2021-32949",
"STATE": "PUBLIC",
"TITLE": "MDT AutoSave Relative Path Traversal"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "MDT AutoSave",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "6.02.06"
}
]
}
},
{
"product_name": "MDT AutoSave",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "7.00",
"version_value": "7.04"
}
]
}
},
{
"product_name": "AutoSave for System Platform (A4SP)",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "4.01"
}
]
}
},
{
"product_name": "A4SP",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "5.00"
}
]
}
}
]
},
"vendor_name": "MDT Software"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Amir Preminger of Claroty Research reported these vulnerabilities to MDT Software."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An attacker could utilize a function in MDT AutoSave versions prior to v6.02.06 that permits changing a designated path to another path and traversing the directory, allowing the replacement of an existing file with a malicious file."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-23: Relative Path Traversal"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-189-02",
"refsource": "CONFIRM",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-189-02"
}
]
},
"solution": [
{
"lang": "en",
"value": "Updated versions of MDT AutoSave and AutoSave for System Platform (A4SP) were developed to address these vulnerabilities as follows:\nMDT AutoSave 6.x version: Version 6.02.06 (Released January 2021)\nMDT AutoSave 7.x version: Version 7.05 (Released December 2020)\nA4SP 4.x version: Version 4.01 (Released June 2021)\nA4SP 5.x version: Version 5.01 (Released May 2021)\n\nFor more information about these vulnerabilities, and to obtain and install the new versions, please contact MDT Software customer support."
}
],
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2021-32949",
"datePublished": "2022-04-01T22:17:09.000Z",
"dateReserved": "2021-05-13T00:00:00.000Z",
"dateUpdated": "2025-04-16T16:34:03.231Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-32957 (GCVE-0-2021-32957)
Vulnerability from cvelistv5 – Published: 2022-04-01 22:17 – Updated: 2025-04-16 16:34
VLAI?
Title
MDT AutoSave Uncontrolled Search Path Element
Summary
A function in MDT AutoSave versions prior to v6.02.06 is used to retrieve system information for a specific process, and this information collection executes multiple commands and summarizes the information into an XML. This function and subsequent process gives full path to the executable and is therefore vulnerable to binary hijacking.
Severity ?
7.5 (High)
CWE
- CWE-89 - SQL Injection
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| MDT Software | MDT AutoSave |
Affected:
unspecified , < 6.02.06
(custom)
|
|||||||||||||||||
|
|||||||||||||||||||
Credits
Amir Preminger of Claroty Research reported these vulnerabilities to MDT Software.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:33:56.379Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-189-02"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-32957",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-16T15:58:26.135784Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-16T16:34:14.242Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "MDT AutoSave",
"vendor": "MDT Software",
"versions": [
{
"lessThan": "6.02.06",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "MDT AutoSave",
"vendor": "MDT Software",
"versions": [
{
"lessThan": "7.04",
"status": "affected",
"version": "7.00",
"versionType": "custom"
}
]
},
{
"product": "AutoSave for System Platform (A4SP)",
"vendor": "MDT Software",
"versions": [
{
"lessThan": "4.01",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "A4SP",
"vendor": "MDT Software",
"versions": [
{
"status": "affected",
"version": "5.00"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Amir Preminger of Claroty Research reported these vulnerabilities to MDT Software."
}
],
"descriptions": [
{
"lang": "en",
"value": "A function in MDT AutoSave versions prior to v6.02.06 is used to retrieve system information for a specific process, and this information collection executes multiple commands and summarizes the information into an XML. This function and subsequent process gives full path to the executable and is therefore vulnerable to binary hijacking."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-04-01T22:17:08.000Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-189-02"
}
],
"solutions": [
{
"lang": "en",
"value": "Updated versions of MDT AutoSave and AutoSave for System Platform (A4SP) were developed to address these vulnerabilities as follows:\nMDT AutoSave 6.x version: Version 6.02.06 (Released January 2021)\nMDT AutoSave 7.x version: Version 7.05 (Released December 2020)\nA4SP 4.x version: Version 4.01 (Released June 2021)\nA4SP 5.x version: Version 5.01 (Released May 2021)\n\nFor more information about these vulnerabilities, and to obtain and install the new versions, please contact MDT Software customer support."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "MDT AutoSave Uncontrolled Search Path Element",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"ID": "CVE-2021-32957",
"STATE": "PUBLIC",
"TITLE": "MDT AutoSave Uncontrolled Search Path Element"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "MDT AutoSave",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "6.02.06"
}
]
}
},
{
"product_name": "MDT AutoSave",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "7.00",
"version_value": "7.04"
}
]
}
},
{
"product_name": "AutoSave for System Platform (A4SP)",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "4.01"
}
]
}
},
{
"product_name": "A4SP",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "5.00"
}
]
}
}
]
},
"vendor_name": "MDT Software"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Amir Preminger of Claroty Research reported these vulnerabilities to MDT Software."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A function in MDT AutoSave versions prior to v6.02.06 is used to retrieve system information for a specific process, and this information collection executes multiple commands and summarizes the information into an XML. This function and subsequent process gives full path to the executable and is therefore vulnerable to binary hijacking."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-89: SQL Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-189-02",
"refsource": "CONFIRM",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-189-02"
}
]
},
"solution": [
{
"lang": "en",
"value": "Updated versions of MDT AutoSave and AutoSave for System Platform (A4SP) were developed to address these vulnerabilities as follows:\nMDT AutoSave 6.x version: Version 6.02.06 (Released January 2021)\nMDT AutoSave 7.x version: Version 7.05 (Released December 2020)\nA4SP 4.x version: Version 4.01 (Released June 2021)\nA4SP 5.x version: Version 5.01 (Released May 2021)\n\nFor more information about these vulnerabilities, and to obtain and install the new versions, please contact MDT Software customer support."
}
],
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2021-32957",
"datePublished": "2022-04-01T22:17:08.000Z",
"dateReserved": "2021-05-13T00:00:00.000Z",
"dateUpdated": "2025-04-16T16:34:14.242Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-32937 (GCVE-0-2021-32937)
Vulnerability from cvelistv5 – Published: 2022-04-01 22:17 – Updated: 2025-04-16 16:34
VLAI?
Title
MDT AutoSave Generation of Error Message Containing Sensitive Information
Summary
An attacker can gain knowledge of a session temporary working folder where the getfile and putfile commands are used in MDT AutoSave versions prior to v6.02.06. An attacker can leverage this knowledge to provide a malicious command to the working directory where the read and write activity can be initiated.
Severity ?
7.5 (High)
CWE
- CWE-209 - Generation of Error Message Containing Sensitive Information
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| MDT Software | MDT AutoSave |
Affected:
unspecified , < 6.02.06
(custom)
|
|||||||||||||||||
|
|||||||||||||||||||
Credits
Amir Preminger of Claroty Research reported these vulnerabilities to MDT Software.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:33:56.081Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-189-02"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-32937",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-16T15:58:28.877367Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-16T16:34:22.011Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "MDT AutoSave",
"vendor": "MDT Software",
"versions": [
{
"lessThan": "6.02.06",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "MDT AutoSave",
"vendor": "MDT Software",
"versions": [
{
"lessThan": "7.04",
"status": "affected",
"version": "7.00",
"versionType": "custom"
}
]
},
{
"product": "AutoSave for System Platform (A4SP)",
"vendor": "MDT Software",
"versions": [
{
"lessThan": "4.01",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "A4SP",
"vendor": "MDT Software",
"versions": [
{
"status": "affected",
"version": "5.00"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Amir Preminger of Claroty Research reported these vulnerabilities to MDT Software."
}
],
"descriptions": [
{
"lang": "en",
"value": "An attacker can gain knowledge of a session temporary working folder where the getfile and putfile commands are used in MDT AutoSave versions prior to v6.02.06. An attacker can leverage this knowledge to provide a malicious command to the working directory where the read and write activity can be initiated."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-209",
"description": "CWE-209: Generation of Error Message Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-04-01T22:17:07.000Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-189-02"
}
],
"solutions": [
{
"lang": "en",
"value": "Updated versions of MDT AutoSave and AutoSave for System Platform (A4SP) were developed to address these vulnerabilities as follows:\nMDT AutoSave 6.x version: Version 6.02.06 (Released January 2021)\nMDT AutoSave 7.x version: Version 7.05 (Released December 2020)\nA4SP 4.x version: Version 4.01 (Released June 2021)\nA4SP 5.x version: Version 5.01 (Released May 2021)\n\nFor more information about these vulnerabilities, and to obtain and install the new versions, please contact MDT Software customer support."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "MDT AutoSave Generation of Error Message Containing Sensitive Information",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"ID": "CVE-2021-32937",
"STATE": "PUBLIC",
"TITLE": "MDT AutoSave Generation of Error Message Containing Sensitive Information"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "MDT AutoSave",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "6.02.06"
}
]
}
},
{
"product_name": "MDT AutoSave",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "7.00",
"version_value": "7.04"
}
]
}
},
{
"product_name": "AutoSave for System Platform (A4SP)",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "4.01"
}
]
}
},
{
"product_name": "A4SP",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "5.00"
}
]
}
}
]
},
"vendor_name": "MDT Software"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Amir Preminger of Claroty Research reported these vulnerabilities to MDT Software."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An attacker can gain knowledge of a session temporary working folder where the getfile and putfile commands are used in MDT AutoSave versions prior to v6.02.06. An attacker can leverage this knowledge to provide a malicious command to the working directory where the read and write activity can be initiated."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-209: Generation of Error Message Containing Sensitive Information"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-189-02",
"refsource": "CONFIRM",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-189-02"
}
]
},
"solution": [
{
"lang": "en",
"value": "Updated versions of MDT AutoSave and AutoSave for System Platform (A4SP) were developed to address these vulnerabilities as follows:\nMDT AutoSave 6.x version: Version 6.02.06 (Released January 2021)\nMDT AutoSave 7.x version: Version 7.05 (Released December 2020)\nA4SP 4.x version: Version 4.01 (Released June 2021)\nA4SP 5.x version: Version 5.01 (Released May 2021)\n\nFor more information about these vulnerabilities, and to obtain and install the new versions, please contact MDT Software customer support."
}
],
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2021-32937",
"datePublished": "2022-04-01T22:17:07.000Z",
"dateReserved": "2021-05-13T00:00:00.000Z",
"dateUpdated": "2025-04-16T16:34:22.011Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-32933 (GCVE-0-2021-32933)
Vulnerability from cvelistv5 – Published: 2022-04-01 22:17 – Updated: 2025-04-16 16:34
VLAI?
Title
MDT AutoSave Command Injection
Summary
An attacker could leverage an API to pass along a malicious file that could then manipulate the process creation command line in MDT AutoSave versions prior to v6.02.06 and run a command line argument. This could then be leveraged to run a malicious process.
Severity ?
10 (Critical)
CWE
- CWE-77 - Command Injection
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| MDT Software | MDT AutoSave |
Affected:
unspecified , < 6.02.06
(custom)
|
|||||||||||||||||
|
|||||||||||||||||||
Credits
Amir Preminger of Claroty Research reported these vulnerabilities to MDT Software.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:33:56.231Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-189-02"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-32933",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-16T15:58:32.346743Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-16T16:34:34.295Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "MDT AutoSave",
"vendor": "MDT Software",
"versions": [
{
"lessThan": "6.02.06",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "MDT AutoSave",
"vendor": "MDT Software",
"versions": [
{
"lessThan": "7.04",
"status": "affected",
"version": "7.00",
"versionType": "custom"
}
]
},
{
"product": "AutoSave for System Platform (A4SP)",
"vendor": "MDT Software",
"versions": [
{
"lessThan": "4.01",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "A4SP",
"vendor": "MDT Software",
"versions": [
{
"status": "affected",
"version": "5.00"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Amir Preminger of Claroty Research reported these vulnerabilities to MDT Software."
}
],
"descriptions": [
{
"lang": "en",
"value": "An attacker could leverage an API to pass along a malicious file that could then manipulate the process creation command line in MDT AutoSave versions prior to v6.02.06 and run a command line argument. This could then be leveraged to run a malicious process."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77: Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-04-01T22:17:06.000Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-189-02"
}
],
"solutions": [
{
"lang": "en",
"value": "Updated versions of MDT AutoSave and AutoSave for System Platform (A4SP) were developed to address these vulnerabilities as follows:\nMDT AutoSave 6.x version: Version 6.02.06 (Released January 2021)\nMDT AutoSave 7.x version: Version 7.05 (Released December 2020)\nA4SP 4.x version: Version 4.01 (Released June 2021)\nA4SP 5.x version: Version 5.01 (Released May 2021)\n\nFor more information about these vulnerabilities, and to obtain and install the new versions, please contact MDT Software customer support."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "MDT AutoSave Command Injection",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"ID": "CVE-2021-32933",
"STATE": "PUBLIC",
"TITLE": "MDT AutoSave Command Injection"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "MDT AutoSave",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "6.02.06"
}
]
}
},
{
"product_name": "MDT AutoSave",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "7.00",
"version_value": "7.04"
}
]
}
},
{
"product_name": "AutoSave for System Platform (A4SP)",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "4.01"
}
]
}
},
{
"product_name": "A4SP",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "5.00"
}
]
}
}
]
},
"vendor_name": "MDT Software"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Amir Preminger of Claroty Research reported these vulnerabilities to MDT Software."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An attacker could leverage an API to pass along a malicious file that could then manipulate the process creation command line in MDT AutoSave versions prior to v6.02.06 and run a command line argument. This could then be leveraged to run a malicious process."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-77: Command Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-189-02",
"refsource": "CONFIRM",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-189-02"
}
]
},
"solution": [
{
"lang": "en",
"value": "Updated versions of MDT AutoSave and AutoSave for System Platform (A4SP) were developed to address these vulnerabilities as follows:\nMDT AutoSave 6.x version: Version 6.02.06 (Released January 2021)\nMDT AutoSave 7.x version: Version 7.05 (Released December 2020)\nA4SP 4.x version: Version 4.01 (Released June 2021)\nA4SP 5.x version: Version 5.01 (Released May 2021)\n\nFor more information about these vulnerabilities, and to obtain and install the new versions, please contact MDT Software customer support."
}
],
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2021-32933",
"datePublished": "2022-04-01T22:17:06.000Z",
"dateReserved": "2021-05-13T00:00:00.000Z",
"dateUpdated": "2025-04-16T16:34:34.295Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-32953 (GCVE-0-2021-32953)
Vulnerability from cvelistv5 – Published: 2022-04-01 22:17 – Updated: 2025-04-16 16:34
VLAI?
Title
MDT AutoSave SQL Injection
Summary
An attacker could utilize SQL commands to create a new user MDT AutoSave versions prior to v6.02.06 and update the user’s permissions, granting the attacker the ability to login.
Severity ?
9.8 (Critical)
CWE
- CWE-89 - SQL Injection
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| MDT Software | MDT AutoSave |
Affected:
unspecified , < 6.02.06
(custom)
|
|||||||||||||||||
|
|||||||||||||||||||
Credits
Amir Preminger of Claroty Research reported these vulnerabilities to MDT Software.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:33:56.023Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-189-02"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-32953",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-16T15:56:37.488128Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-16T16:34:44.784Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "MDT AutoSave",
"vendor": "MDT Software",
"versions": [
{
"lessThan": "6.02.06",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "MDT AutoSave",
"vendor": "MDT Software",
"versions": [
{
"lessThan": "7.04",
"status": "affected",
"version": "7.00",
"versionType": "custom"
}
]
},
{
"product": "AutoSave for System Platform (A4SP)",
"vendor": "MDT Software",
"versions": [
{
"lessThan": "4.01",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "A4SP",
"vendor": "MDT Software",
"versions": [
{
"status": "affected",
"version": "5.00"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Amir Preminger of Claroty Research reported these vulnerabilities to MDT Software."
}
],
"descriptions": [
{
"lang": "en",
"value": "An attacker could utilize SQL commands to create a new user MDT AutoSave versions prior to v6.02.06 and update the user\u2019s permissions, granting the attacker the ability to login."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-04-01T22:17:05.000Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-189-02"
}
],
"solutions": [
{
"lang": "en",
"value": "Updated versions of MDT AutoSave and AutoSave for System Platform (A4SP) were developed to address these vulnerabilities as follows:\nMDT AutoSave 6.x version: Version 6.02.06 (Released January 2021)\nMDT AutoSave 7.x version: Version 7.05 (Released December 2020)\nA4SP 4.x version: Version 4.01 (Released June 2021)\nA4SP 5.x version: Version 5.01 (Released May 2021)\n\nFor more information about these vulnerabilities, and to obtain and install the new versions, please contact MDT Software customer support."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "MDT AutoSave SQL Injection",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"ID": "CVE-2021-32953",
"STATE": "PUBLIC",
"TITLE": "MDT AutoSave SQL Injection"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "MDT AutoSave",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "6.02.06"
}
]
}
},
{
"product_name": "MDT AutoSave",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "7.00",
"version_value": "7.04"
}
]
}
},
{
"product_name": "AutoSave for System Platform (A4SP)",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "4.01"
}
]
}
},
{
"product_name": "A4SP",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "5.00"
}
]
}
}
]
},
"vendor_name": "MDT Software"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Amir Preminger of Claroty Research reported these vulnerabilities to MDT Software."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An attacker could utilize SQL commands to create a new user MDT AutoSave versions prior to v6.02.06 and update the user\u2019s permissions, granting the attacker the ability to login."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-89: SQL Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-189-02",
"refsource": "CONFIRM",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-189-02"
}
]
},
"solution": [
{
"lang": "en",
"value": "Updated versions of MDT AutoSave and AutoSave for System Platform (A4SP) were developed to address these vulnerabilities as follows:\nMDT AutoSave 6.x version: Version 6.02.06 (Released January 2021)\nMDT AutoSave 7.x version: Version 7.05 (Released December 2020)\nA4SP 4.x version: Version 4.01 (Released June 2021)\nA4SP 5.x version: Version 5.01 (Released May 2021)\n\nFor more information about these vulnerabilities, and to obtain and install the new versions, please contact MDT Software customer support."
}
],
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2021-32953",
"datePublished": "2022-04-01T22:17:05.000Z",
"dateReserved": "2021-05-13T00:00:00.000Z",
"dateUpdated": "2025-04-16T16:34:44.784Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-32961 (GCVE-0-2021-32961)
Vulnerability from cvelistv5 – Published: 2022-04-01 22:17 – Updated: 2025-04-16 16:34
VLAI?
Title
MDT AutoSave Unrestricted Upload of File with Dangerous Type
Summary
A getfile function in MDT AutoSave versions prior to v6.02.06 enables a user to supply an optional parameter, resulting in the processing of a request in a special manner. This can result in the execution of an unzip command and place a malicious .exe file in one of the locations the function looks for and get execution capabilities.
Severity ?
7.5 (High)
CWE
- CWE-434 - Unrestricted Upload of File with Dangerous Type
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| MDT Software | MDT AutoSave |
Affected:
unspecified , < 6.02.06
(custom)
|
|||||||||||||||||
|
|||||||||||||||||||
Credits
Amir Preminger of Claroty Research reported these vulnerabilities to MDT Software.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:33:56.011Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-189-02"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-32961",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-16T15:58:35.075405Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-16T16:34:53.745Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "MDT AutoSave",
"vendor": "MDT Software",
"versions": [
{
"lessThan": "6.02.06",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "MDT AutoSave",
"vendor": "MDT Software",
"versions": [
{
"lessThan": "7.04",
"status": "affected",
"version": "7.00",
"versionType": "custom"
}
]
},
{
"product": "AutoSave for System Platform (A4SP)",
"vendor": "MDT Software",
"versions": [
{
"lessThan": "4.01",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "A4SP",
"vendor": "MDT Software",
"versions": [
{
"status": "affected",
"version": "5.00"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Amir Preminger of Claroty Research reported these vulnerabilities to MDT Software."
}
],
"descriptions": [
{
"lang": "en",
"value": "A getfile function in MDT AutoSave versions prior to v6.02.06 enables a user to supply an optional parameter, resulting in the processing of a request in a special manner. This can result in the execution of an unzip command and place a malicious .exe file in one of the locations the function looks for and get execution capabilities."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-04-01T22:17:04.000Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-189-02"
}
],
"solutions": [
{
"lang": "en",
"value": "Updated versions of MDT AutoSave and AutoSave for System Platform (A4SP) were developed to address these vulnerabilities as follows:\nMDT AutoSave 6.x version: Version 6.02.06 (Released January 2021)\nMDT AutoSave 7.x version: Version 7.05 (Released December 2020)\nA4SP 4.x version: Version 4.01 (Released June 2021)\nA4SP 5.x version: Version 5.01 (Released May 2021)\n\nFor more information about these vulnerabilities, and to obtain and install the new versions, please contact MDT Software customer support."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "MDT AutoSave Unrestricted Upload of File with Dangerous Type",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"ID": "CVE-2021-32961",
"STATE": "PUBLIC",
"TITLE": "MDT AutoSave Unrestricted Upload of File with Dangerous Type"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "MDT AutoSave",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "6.02.06"
}
]
}
},
{
"product_name": "MDT AutoSave",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "7.00",
"version_value": "7.04"
}
]
}
},
{
"product_name": "AutoSave for System Platform (A4SP)",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "4.01"
}
]
}
},
{
"product_name": "A4SP",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "5.00"
}
]
}
}
]
},
"vendor_name": "MDT Software"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Amir Preminger of Claroty Research reported these vulnerabilities to MDT Software."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A getfile function in MDT AutoSave versions prior to v6.02.06 enables a user to supply an optional parameter, resulting in the processing of a request in a special manner. This can result in the execution of an unzip command and place a malicious .exe file in one of the locations the function looks for and get execution capabilities."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-434: Unrestricted Upload of File with Dangerous Type"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-189-02",
"refsource": "CONFIRM",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-189-02"
}
]
},
"solution": [
{
"lang": "en",
"value": "Updated versions of MDT AutoSave and AutoSave for System Platform (A4SP) were developed to address these vulnerabilities as follows:\nMDT AutoSave 6.x version: Version 6.02.06 (Released January 2021)\nMDT AutoSave 7.x version: Version 7.05 (Released December 2020)\nA4SP 4.x version: Version 4.01 (Released June 2021)\nA4SP 5.x version: Version 5.01 (Released May 2021)\n\nFor more information about these vulnerabilities, and to obtain and install the new versions, please contact MDT Software customer support."
}
],
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2021-32961",
"datePublished": "2022-04-01T22:17:04.000Z",
"dateReserved": "2021-05-13T00:00:00.000Z",
"dateUpdated": "2025-04-16T16:34:53.745Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}