critical9.1Public exploit code
CVE-2021-37425
Altova MobileTogether Server before 7.3 SP1 allows XXE attacks, such as an InfoSetChanges/Changes attack against /workflowmanagement, or reading mobiletogether…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Altova MobileTogether Server 7.3 - XML External Entity Injection (XXE)2021-08-12 · webapps · multiple
Impact
Altova MobileTogether Server before 7.3 SP1 allows XXE attacks, such as an InfoSetChanges/Changes attack against /workflowmanagement, or reading mobiletogetherserver.cfg and then reading the certificate and private key.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Altova | Mobiletogether Server | from 7.0 before 7.3 Version 7.3 |
Weakness classification
References
- NVD record
- CVE.org record
- http://seclists.org/fulldisclosure/2021/Aug/12
- https://www.altova.com/mobiletogether
- https://www.redteam-pentesting.de/advisories/rt-sa-2021-002
- https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses
- http://seclists.org/fulldisclosure/2021/Aug/12
- https://www.altova.com/mobiletogether
- https://www.redteam-pentesting.de/advisories/rt-sa-2021-002
- https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses