CVE-2021-32953 CRITICAL

CVE-2021-32953: MDT AutoSave SQL Injection

Vendor Mdt Software

Product MDT AutoSave

Weakness CWE-89 · SQLi

Published April 1, 2022

Last update April 16, 2025

View on NVD All CVEs

CVSS base score

9.8/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

An attacker could utilize SQL commands to create a new user MDT AutoSave versions prior to v6.02.06 and update the user’s permissions, granting the attacker the ability to login.

Key dates

02Disclosure timeline

April 1, 2022 CVE published

April 16, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2021-32953 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html

Related vulnerabilities

Identifiers

CVE CVE-2021-32953

CWE CWE-89

CVSS 9.8 / CRITICAL

Affected versions

Vendor Mdt Software

Product MDT AutoSave

Affected ≥ unspecified and < 6.02.06

Vendor Mdt Software

Product MDT AutoSave

Affected ≥ 7.00 and < 7.04

Vendor Mdt Software

Product AutoSave for System Platform (A4SP)

Affected ≥ unspecified and < 4.01

Vendor Mdt Software

Product A4SP

Affected 5.00

CVE-2021-32953: MDT AutoSave SQL Injection

01Description

02Disclosure timeline

03References

04Related CVE