CVE-2021-33577: 
Cleo LexiCom vulnerability analysis and mitigation

An issue was discovered in Cleo LexiCom 5.5.0.0. The requirement for the sender of an AS2 message to identify themselves (via encryption and signing of the message) can be bypassed by changing the Content-Type of the message to text/plain. This vulnerability was discovered in 2021 and affects the AS2 message processing functionality of the application (Atredis Advisory, NVD).

The vulnerability exists in the AS2 message processing functionality where the authentication requirement can be circumvented by modifying the Content-Type header to text/plain. The CVSS v3.1 base score is 5.3 (MEDIUM) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N (NVD).

This vulnerability allows an attacker to bypass the requirement for message encryption and signing in AS2 communications. This could enable unauthorized parties to send messages while impersonating legitimate trading partners (Atredis Advisory).

It is unknown if later versions of LexiCom address this issue. A partial mitigation may be possible by requiring in-bound messages to be signed and encrypted, configured on a partner-by-partner basis. However, this would not prevent a trading partner from exploiting the vulnerability (Atredis Advisory).