CVE-2021-33576

Name of the Vulnerable Software and Affected Versions Cleo LexiCom version 5.5.0.0

Description An issue was discovered in Cleo LexiCom where the sender can specify a filename within the AS2 message. This filename can include path-traversal characters, allowing the file to be written to an arbitrary location on disk.

Recommendations For Cleo LexiCom version 5.5.0.0, as a temporary workaround, consider restricting the ability for senders to specify filenames within AS2 messages until a patch is available. Additionally, restrict access to sensitive directories to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.