Message Authentication Bypass in Cleo LexiCom by Cleo
CVE-2021-33577

5.3MEDIUM

Key Information:

Vendor

Cleo

Status
Lexicom
Vendor
CVE Published:
18 June 2021

What is CVE-2021-33577?

In Cleo LexiCom version 5.5.0.0, a vulnerability allows an attacker to bypass the requirement for AS2 message authentication. This is achieved by altering the message's Content-Type to text/plain, which undermines the intended security measures of sender identification through encryption and signing. Without appropriate safeguarding, this flaw can expose sensitive data to unauthorized access, emphasizing the necessity for immediate remediation to secure message exchanges.

References

https://github.com/atredispartners/advisories/blob/master...
x_refsource_MISC
https://www.cleo.com/cleo-lexicom
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.