CVE-2021-37425

moderate-risk
Published 2021-08-10

Altova MobileTogether Server before 7.3 SP1 allows XXE attacks, such as an InfoSetChanges/Changes attack against /workflowmanagement, or reading mobiletogetherserver.cfg and then reading the certificate and private key.

Do I need to act?

~
8.7% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
!
1 public exploit available
50191
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.1/10 Critical
NETWORK / LOW complexity

Affected Products (2)

Mobiletogether Server
Mobiletogether Server

Affected Vendors

Altova

References (8)

Exploit http://seclists.org/fulldisclosure/2021/Aug/12
Vendor Advisory https://www.altova.com/mobiletogether
Exploit https://www.redteam-pentesting.de/advisories/rt-sa-2021-002
Third Party Advisory https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerabi...
Exploit http://seclists.org/fulldisclosure/2021/Aug/12
Vendor Advisory https://www.altova.com/mobiletogether
Exploit https://www.redteam-pentesting.de/advisories/rt-sa-2021-002
Third Party Advisory https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerabi...
48
/ 100
moderate-risk
Severity 31/34 · Critical
Exploitability 10/34 · Low
Exposure 7/34 · Low