Read the docs
TI-2023-21752 Aliases CVE-2023-41137GHSA-9r9g-gv68-x7hw

Hard-coded credentials in AppsAnywhere Client

Priority MEDIUM 43CWE-321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-321.

Summary

Symmetric encryption used to protect messages between the AppsAnywhere server and client can be broken by reverse engineering the client and used to impersonate the AppsAnywhere server.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00341 27th percentileScored 2026-11-07
Fix Fixed AppsAnywhere Client (AppsAnywhere): 1.6.1, 2.0.1, 2.2.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AppsAnywhereAppsAnywhere Client1.4.0; 1.4.1; 1.5.1; 1.5.2; 1.6.0; 2.0.01.6.1, 2.0.1, 2.2.0Patch availableCNA
  • AppsAnywhere Client VendorAppsAnywhere Affected 1.4.0; 1.4.1; 1.5.1; 1.5.2; 1.6.0; 2.0.0 Fixed in 1.6.1, 2.0.1, 2.2.0 Patch available CNA

CPE configurations NVD · 11

CPEVersionsRoleVendor
cpe:2.3:a:appsanywhere:appsanywhere_client:1.4.0:*:*:*:*:windows:*:*1.4.0VulnerableAppsAnywhere
cpe:2.3:a:appsanywhere:appsanywhere_client:1.4.1:*:*:*:*:windows:*:*1.4.1VulnerableAppsAnywhere
cpe:2.3:a:appsanywhere:appsanywhere_client:1.5.1:*:*:*:*:windows:*:*1.5.1VulnerableAppsAnywhere
cpe:2.3:a:appsanywhere:appsanywhere_client:1.6.0:*:*:*:*:windows:*:*1.6.0VulnerableAppsAnywhere
cpe:2.3:a:appsanywhere:appsanywhere_client:2.0.0:*:*:*:*:windows:*:*2.0.0VulnerableAppsAnywhere
cpe:2.3:a:appsanywhere:appsanywhere_client:1.4.0:*:*:*:*:macos:*:*1.4.0VulnerableAppsAnywhere
cpe:2.3:a:appsanywhere:appsanywhere_client:1.4.1:*:*:*:*:macos:*:*1.4.1VulnerableAppsAnywhere
cpe:2.3:a:appsanywhere:appsanywhere_client:1.5.1:*:*:*:*:macos:*:*1.5.1VulnerableAppsAnywhere
cpe:2.3:a:appsanywhere:appsanywhere_client:1.5.2:*:*:*:*:macos:*:*1.5.2VulnerableAppsAnywhere
cpe:2.3:a:appsanywhere:appsanywhere_client:1.6.0:*:*:*:*:macos:*:*1.6.0VulnerableAppsAnywhere
  • cpe:2.3:a:appsanywhere:appsanywhere_client:1.4.0:*:*:*:*:windows:*:* Versions 1.4.0 Vulnerable ·AppsAnywhere
  • cpe:2.3:a:appsanywhere:appsanywhere_client:1.4.1:*:*:*:*:windows:*:* Versions 1.4.1 Vulnerable ·AppsAnywhere
  • cpe:2.3:a:appsanywhere:appsanywhere_client:1.5.1:*:*:*:*:windows:*:* Versions 1.5.1 Vulnerable ·AppsAnywhere
  • cpe:2.3:a:appsanywhere:appsanywhere_client:1.6.0:*:*:*:*:windows:*:* Versions 1.6.0 Vulnerable ·AppsAnywhere
  • cpe:2.3:a:appsanywhere:appsanywhere_client:2.0.0:*:*:*:*:windows:*:* Versions 2.0.0 Vulnerable ·AppsAnywhere
  • cpe:2.3:a:appsanywhere:appsanywhere_client:1.4.0:*:*:*:*:macos:*:* Versions 1.4.0 Vulnerable ·AppsAnywhere
  • cpe:2.3:a:appsanywhere:appsanywhere_client:1.4.1:*:*:*:*:macos:*:* Versions 1.4.1 Vulnerable ·AppsAnywhere
  • cpe:2.3:a:appsanywhere:appsanywhere_client:1.5.1:*:*:*:*:macos:*:* Versions 1.5.1 Vulnerable ·AppsAnywhere
  • cpe:2.3:a:appsanywhere:appsanywhere_client:1.5.2:*:*:*:*:macos:*:* Versions 1.5.2 Vulnerable ·AppsAnywhere
  • cpe:2.3:a:appsanywhere:appsanywhere_client:1.6.0:*:*:*:*:macos:*:* Versions 1.6.0 Vulnerable ·AppsAnywhere
Show 1 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:appsanywhere:appsanywhere_client:2.0.0:*:*:*:*:macos:*:*2.0.0VulnerableAppsAnywhere
  • cpe:2.3:a:appsanywhere:appsanywhere_client:2.0.0:*:*:*:*:macos:*:* Versions 2.0.0 Vulnerable ·AppsAnywhere

Remediation

  • Fix · CNA AppsAnywhere Client (AppsAnywhere) Fixed in 1.6.1, 2.0.1, 2.2.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-41137
  2. 2026-10-03 Alias added: GHSA-9r9g-gv68-x7hw

References

Advisory 1

  • TI-2023-21753 Improper privilege management in AppsAnywhere Client CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences