CVE-2021-37425

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Altova MobileTogether Server before 7.3 SP1 allows XXE attacks, such as an InfoSetChanges/Changes attack against /workflowmanagement, or reading mobiletogetherserver.cfg and then reading the certificate and private key.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://seclists.org/fulldisclosure/2021/Aug/12Exploit, Mailing List, Third Party Advisory
https://www.altova.com/mobiletogetherVendor Advisory
https://www.redteam-pentesting.de/advisories/rt-sa-2021-002Exploit, Third Party Advisory
https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analysesThird Party Advisory
http://seclists.org/fulldisclosure/2021/Aug/12Exploit, Mailing List, Third Party Advisory
https://www.altova.com/mobiletogetherVendor Advisory
https://www.redteam-pentesting.de/advisories/rt-sa-2021-002Exploit, Third Party Advisory
https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analysesThird Party Advisory

Timeline

Published: Aug 10, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-37437.1An out-of-bounds (OOB) memory read flaw was found in the Qualcomm IPC router protocol in the Linux kernel. A missing sanity check allows a l CVE-2021-374364.2Amazon Echo Dot devices through 2021-07-02 sometimes allow attackers, who have physical access to a device after a factory reset, to obtain CVE-2021-374396.5NCH FlexiServer v6.00 suffers from a syslog?file=/.. path traversal vulnerability.CVE-2021-37445.5A memory leak flaw was found in the Linux kernel in the ccp_run_aes_gcm_cmd() function in drivers/crypto/ccp/ccp-ops.c, which allows attacke CVE-2021-374406.5NCH Axon PBX v2.22 and earlier allows path traversal for file disclosure via the logprop?file=/.. substring.CVE-2021-374418.8NCH Axon PBX v2.22 and earlier allows path traversal for file deletion via the logdelete?file=/.. substring.CVE-2021-374426.5NCH IVM Attendant v5.12 and earlier allows path traversal via viewfile?file=/.. to read files.CVE-2021-374438.1NCH IVM Attendant v5.12 and earlier allows path traversal via the logdeleteselected check0 parameter for file deletion.CVE-2021-374448.8NCH IVM Attendant v5.12 and earlier suffers from a directory traversal weakness upon uploading plugins in a ZIP archive. This can lead to co CVE-2021-374456.5In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via logprop?file=/.. for file reading.CVE-2021-374464.3In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentprop?file=/.. for file reading.CVE-2021-374478.1In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentdelete?file=/.. for file deletion.