Lucene search

AutodeskCVE-2023-25002

HistoryJun 27, 2023 - 11:15 p.m.

CVE-2023-25002

2023-06-2723:15:09

CWE-416

autodesk

web.nvd.nist.gov

cve-2023-25002

skp file

autodesk products

use-after-free vulnerability

code execution

nvd

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.8

Confidence

High

EPSS

0.001

Percentile

23.1%

JSON

A maliciously crafted SKP file in Autodesk products is used to trigger use-after-free vulnerability. Exploitation of this vulnerability may lead to code execution.

Affected configurations

Nvd

Node

autodesk3ds_maxMatch2022

autodesk3ds_maxMatch2023

autodesknavisworksMatch2022

autodesknavisworksMatch2023

autodeskrevitMatch2022

autodeskrevitMatch2023

autodeskvredMatch2023

VendorProductVersionCPE
autodesk3ds_max2022cpe:2.3:a:autodesk:3ds_max:2022:*:*:*:*:*:*:*
autodesk3ds_max2023cpe:2.3:a:autodesk:3ds_max:2023:*:*:*:*:*:*:*
autodesknavisworks2022cpe:2.3:a:autodesk:navisworks:2022:*:*:*:*:*:*:*
autodesknavisworks2023cpe:2.3:a:autodesk:navisworks:2023:*:*:*:*:*:*:*
autodeskrevit2022cpe:2.3:a:autodesk:revit:2022:*:*:*:*:*:*:*
autodeskrevit2023cpe:2.3:a:autodesk:revit:2023:*:*:*:*:*:*:*
autodeskvred2023cpe:2.3:a:autodesk:vred:2023:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
autodesk	3ds_max	2022	cpe:2.3:a:autodesk:3ds_max:2022:::::::*
autodesk	3ds_max	2023	cpe:2.3:a:autodesk:3ds_max:2023:::::::*
autodesk	navisworks	2022	cpe:2.3:a:autodesk:navisworks:2022:::::::*
autodesk	navisworks	2023	cpe:2.3:a:autodesk:navisworks:2023:::::::*
autodesk	revit	2022	cpe:2.3:a:autodesk:revit:2022:::::::*
autodesk	revit	2023	cpe:2.3:a:autodesk:revit:2023:::::::*
autodesk	vred	2023	cpe:2.3:a:autodesk:vred:2023:::::::*

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "Multiple",
    "versions": [
      {
        "version": "2023, 2022, 2021",
        "status": "affected"
      }
    ]
  }
]

References

www.autodesk.com/trust/security-advisories/adsk-sa-2023-0002

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.8

Confidence

High

EPSS

0.001

Percentile

23.1%

JSON

Related for CVE-2023-25002