CVE-2023-41137

Description

Symmetric encryption used to protect messages between the AppsAnywhere server and client can be broken by reverse engineering the client and used to impersonate the AppsAnywhere server.

Reserved 2023-08-23 | Published 2023-11-09 | Updated 2024-10-28 | Assigner AppCheck

Problem types

Use of Hard-coded Cryptographic Key

Product status

Default status
unaffected

1.4.0
affected

1.4.1
affected

1.5.1
affected

1.5.2
affected

1.6.0
affected

2.0.0
affected

1.6.1
unaffected

2.0.1
unaffected

2.2.0
unaffected

Credits

Gaelan Steele finder

References

docs.appsanywhere.com/...where/3.1/2023-11-security-advisory (AppsAnywhere Security Advisory)

cve.org (CVE-2023-41137)

nvd.nist.gov (CVE-2023-41137)

Download JSON