CVE-2021-32937

MDT AutoSave Generation of Error Message Containing Sensitive Information

Description

An attacker can gain knowledge of a session temporary working folder where the getfile and putfile commands are used in MDT AutoSave versions prior to v6.02.06. An attacker can leverage this knowledge to provide a malicious command to the working directory where the read and write activity can be initiated.

Remediation

Solution:

  • Updated versions of MDT AutoSave and AutoSave for System Platform (A4SP) were developed to address these vulnerabilities as follows: MDT AutoSave 6.x version: Version 6.02.06 (Released January 2021) MDT AutoSave 7.x version: Version 7.05 (Released December 2020) A4SP 4.x version: Version 4.01 (Released June 2021) A4SP 5.x version: Version 5.01 (Released May 2021) For more information about these vulnerabilities, and to obtain and install the new versions, please contact MDT Software customer support.

Category

7.5
CVSS
Severity: High
CVSS 3.1 •
CVSS 2.0 •
EPSS 0.19%
Third-Party Advisory cisa.gov
Affected: MDT Software MDT AutoSave
Affected: MDT Software MDT AutoSave
Affected: MDT Software AutoSave for System Platform (A4SP)
Affected: MDT Software A4SP
Published at:
Updated at:

References

Link Tags
https://www.cisa.gov/uscert/ics/advisories/icsa-21-189-02 third party advisory us government resource

Frequently Asked Questions

What is the severity of CVE-2021-32937?
CVE-2021-32937 has been scored as a high severity vulnerability.
How to fix CVE-2021-32937?
To fix CVE-2021-32937: Updated versions of MDT AutoSave and AutoSave for System Platform (A4SP) were developed to address these vulnerabilities as follows: MDT AutoSave 6.x version: Version 6.02.06 (Released January 2021) MDT AutoSave 7.x version: Version 7.05 (Released December 2020) A4SP 4.x version: Version 4.01 (Released June 2021) A4SP 5.x version: Version 5.01 (Released May 2021) For more information about these vulnerabilities, and to obtain and install the new versions, please contact MDT Software customer support.
Is CVE-2021-32937 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2021-32937 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2021-32937?
CVE-2021-32937 affects MDT Software MDT AutoSave, MDT Software MDT AutoSave, MDT Software AutoSave for System Platform (A4SP), MDT Software A4SP.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.