CVE-2021-33577: Medium severity cleo lexicom vulnerability
An issue was discovered in Cleo LexiCom 5.5.0.0. The requirement for the sender of an AS2 message to identify themselves (via encryption and signing of the message) can be bypassed by changing the Content-Type of the message to text/plain.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-33577?
CVE-2021-33577 has been classified as a critical vulnerability due to the potential for message signing and encryption bypass.
How do I fix CVE-2021-33577?
To fix CVE-2021-33577, update Cleo LexiCom to a version that addresses this vulnerability as per vendor recommendations.
What systems are affected by CVE-2021-33577?
CVE-2021-33577 specifically affects Cleo LexiCom version 5.5.0.0.
What does CVE-2021-33577 allow an attacker to do?
CVE-2021-33577 allows an attacker to bypass sender identification requirements in AS2 messages by altering the message's Content-Type.
Is there a workaround for CVE-2021-33577?
Unfortunately, there is no known workaround for CVE-2021-33577; upgrading to the secure version is the recommended approach.