CVE Vulnerabilities

CVE-2023-41137

Use of Hard-coded Cryptographic Key

Published: Nov 09, 2023 | Modified: Nov 21, 2024
CVSS 3.x
9.8
CRITICAL
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu

Symmetric encryption used to protect messages between the AppsAnywhere server and client can be broken by reverse engineering the client and used to impersonate the AppsAnywhere server.

Weakness

The product uses a hard-coded, unchangeable cryptographic key.

Affected Software

Name Vendor Start Version End Version
Appsanywhere_client Appsanywhere 1.4.0 (including) 1.4.0 (including)
Appsanywhere_client Appsanywhere 1.4.1 (including) 1.4.1 (including)
Appsanywhere_client Appsanywhere 1.5.1 (including) 1.5.1 (including)
Appsanywhere_client Appsanywhere 1.6.0 (including) 1.6.0 (including)
Appsanywhere_client Appsanywhere 2.0.0 (including) 2.0.0 (including)

Potential Mitigations

References