CVE-2021-32961
MDT AutoSave Unrestricted Upload of File with Dangerous Type
Vexday Risk Score
21Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 7.5EPSS 1.2%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
01 abr 2022Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
A getfile function in MDT AutoSave versions prior to v6.02.06 enables a user to supply an optional parameter, resulting in the processing of a request in a special manner. This can result in the execution of an unzip command and place a malicious .exe file in one of the locations the function looks for and get execution capabilities.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Productos afectados
MDT Software · A4SPMDT Software · AutoSave for System Platform (A4SP)MDT Software · MDT AutoSave¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →