by Kastro
Paper/Archive/CVE-2023-41137

CVE-2023-41137

AppsAnywhere AppsAnywhere Client — Symmetric encryption used to protect messages between the AppsAnywhere server and client can be broken by reverse engineering the client…

EPSS 0.3%CVSS 9.8
critical.is priorityof 100
35
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 27.6.276 × 205.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Symmetric encryption used to protect messages between the AppsAnywhere server and client can be broken by reverse engineering the client and used to impersonate the AppsAnywhere server.

Affected

ProductAffectedFixed inSource
AppsAnywhere Client1.4.01.6.1CNA
AppsAnywhere Client1.4.11.6.1CNA
AppsAnywhere Client1.5.11.6.1CNA
AppsAnywhere Client1.5.21.6.1CNA
AppsAnywhere Client1.6.01.6.1CNA
AppsAnywhere Client2.0.02.0.1CNA
appsanywhere_client1.4.0–CISA-ADP
appsanywhere_client1.4.1–CISA-ADP
appsanywhere_client1.5.1–CISA-ADP
appsanywhere_client1.6.0–CISA-ADP
appsanywhere_client2.0.0–CISA-ADP
appsanywhere_client1.5.2–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AppCheck (CNA)8.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refdocs.appsanywhere.com/appsanywhere/3.1/2023-11-security-advisory