CVE-2021-37425

CRITICAL 9.1CVE-2021-37425 · Published 10/08/2021 · updated 17/06/2026

In short

CVE-2021-37425 is a CRITICAL (CVSS 9.1) vulnerability affecting mobiletogether server (altova).
Chance of exploitation in the next 30 days (EPSS): 66.3%, higher than 99.3% of all vulnerabilities.
Fix: update to 7.3 or later.

Package	Affected versions	Patched versions
mobiletogether server altova	`= 7.3≥ 7.0, < 7.3`	`7.3`

Description

Altova MobileTogether Server before 7.3 SP1 allows XXE attacks, such as an InfoSetChanges/Changes attack against /workflowmanagement, or reading mobiletogetherserver.cfg and then reading the certificate and private key.

References

seclists.org/fulldisclosure/2021/Aug/12 · Exploit
altova.com/mobiletogether · Vendor Advisory
redteam-pentesting.de/advisories/rt-sa-2021-002 · Exploit
redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses · Third Party Advisory

More vulnerabilities in mobiletogether server

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free