CVE-2021-32937 - CVE House
Back to Database
Status published High CVE-2021-32937

MDT AutoSave Generation of Error Message Containing Sensitive Information

Vulnerability Description

An attacker can gain knowledge of a session temporary working folder where the getfile and putfile commands are used in MDT AutoSave versions prior to v6.02.06. An attacker can leverage this knowledge to provide a malicious command to the working directory where the read and write activity can be initiated.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-32937

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Amir Preminger of Claroty Research reported these vulnerabilities to MDT Software.

References

More from MDT Software

View All →
CVE-2021-32961
MDT AutoSave Unrestricted Upload of File with Dangerous Type
High 7.5
CVE-2021-32957
MDT AutoSave Uncontrolled Search Path Element
High 7.5
CVE-2021-32953
MDT AutoSave SQL Injection
Critical 9.8
CVE-2021-32949
MDT AutoSave Relative Path Traversal
High 7.5
CVE-2021-32945
MDT AutoSave Inadequate Encryption Strength
High 7.5

Affected Vendor

MDT Software

View all reports →

Affected Software

MDT AutoSave, AutoSave for System Platform (A4SP), A4SP
Vulnerable Versions:
unspecified, 7.00, 5.00

Timeline

Official Publish: April 1st, 2022
Last Modified: April 16th, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-209

MITRE ATT&CK TTPs

T1592 Gather Victim Host Information
Reconnaissance
T1083 File and Directory Discovery
Discovery
T1552 Unsecured Credentials
Credential Access
T1212 Exploitation for Defense Evasion
Defense Evasion
T1005 Data from Local System
Collection