CVE Vulnerabilities

CVE-2023-41137

Use of Hard-coded Cryptographic Key

Published: Nov 09, 2023 | Modified: Nov 21, 2024
CVSS 3.x
9.8
CRITICAL
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu

Symmetric encryption used to protect messages between the AppsAnywhere server and client can be broken by reverse engineering the client and used to impersonate the AppsAnywhere server.

Weakness

The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.

Affected Software

Name Vendor Start Version End Version
Appsanywhere_client Appsanywhere 1.4.0 (including) 1.4.0 (including)
Appsanywhere_client Appsanywhere 1.4.1 (including) 1.4.1 (including)
Appsanywhere_client Appsanywhere 1.5.1 (including) 1.5.1 (including)
Appsanywhere_client Appsanywhere 1.6.0 (including) 1.6.0 (including)
Appsanywhere_client Appsanywhere 2.0.0 (including) 2.0.0 (including)

Potential Mitigations

References