CVEvulnerability

CVE-2023-41137

9.8 CRITICAL Published 2023-11-09 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-11-09
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.0 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-321, CWE-798

Description

Symmetric encryption used to protect messages between the AppsAnywhere server and client can be broken by reverse engineering the client and used to impersonate the AppsAnywhere server.

Affected configurations

• appsanywhere appsanywhere client 1.4.0 • appsanywhere appsanywhere client 1.4.1 • appsanywhere appsanywhere client 1.5.1 • appsanywhere appsanywhere client 1.6.0 • appsanywhere appsanywhere client 2.0.0 • appsanywhere appsanywhere client 1.5.2

Related

Weakness · CWE (2)

  • CWE-321 Use of Hard-coded Cryptographic Key weakness
  • CWE-798 Use of Hard-coded Credentials weakness

References