Lucene search

AutodeskCVE-2023-29074

HistoryNov 23, 2023 - 4:15 a.m.

CVE-2023-29074

2023-11-2304:15:07

CWE-787

autodesk

web.nvd.nist.gov

malicious file

catpart

autodesk autocad

out-of-bounds write

vulnerability

crash

sensitive data

arbitrary code

nvd

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.002

Percentile

61.4%

JSON

A maliciously crafted CATPART file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause an Out-Of-Bounds Write. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.

Affected configurations

Nvd

Node

autodeskautocadRange<2024.1macos

autodeskautocadRange2023.0.0–2023.1.4

autodeskautocadRange2024.0.0–2024.1.1

autodeskautocad_advance_steelRange<2023.1.4

autodeskautocad_advance_steelRange2024.0.0–2024.1.1

autodeskautocad_architectureRange<2023.1.4

autodeskautocad_architectureRange2024.0.0–2024.1.1

autodeskautocad_civil_3dRange<2023.1.4

autodeskautocad_civil_3dRange2024.0.0–2024.1.1

autodeskautocad_electricalRange<2023.1.4

autodeskautocad_electricalRange2024.0.0–2024.1.1

autodeskautocad_ltRange<2023.1.4

autodeskautocad_ltRange<2024.1macos

autodeskautocad_ltRange2024.0.0–2024.1.1

autodeskautocad_map_3dRange<2023.1.4

autodeskautocad_map_3dRange2024.0.0–2024.1.1

autodeskautocad_mechanicalRange<2023.1.4

autodeskautocad_mechanicalRange2024.0.0–2024.1.1

autodeskautocad_mepRange<2023.1.4

autodeskautocad_mepRange2024.0.0–2024.1.1

autodeskautocad_plant_3dRange<2023.1.4

autodeskautocad_plant_3dRange2024.0.0–2024.1.1

VendorProductVersionCPE
autodeskautocad*cpe:2.3:a:autodesk:autocad:*:*:*:*:*:macos:*:*
autodeskautocad*cpe:2.3:a:autodesk:autocad:*:*:*:*:*:*:*:*
autodeskautocad_advance_steel*cpe:2.3:a:autodesk:autocad_advance_steel:*:*:*:*:*:*:*:*
autodeskautocad_architecture*cpe:2.3:a:autodesk:autocad_architecture:*:*:*:*:*:*:*:*
autodeskautocad_civil_3d*cpe:2.3:a:autodesk:autocad_civil_3d:*:*:*:*:*:*:*:*
autodeskautocad_electrical*cpe:2.3:a:autodesk:autocad_electrical:*:*:*:*:*:*:*:*
autodeskautocad_lt*cpe:2.3:a:autodesk:autocad_lt:*:*:*:*:*:*:*:*
autodeskautocad_lt*cpe:2.3:a:autodesk:autocad_lt:*:*:*:*:*:macos:*:*
autodeskautocad_map_3d*cpe:2.3:a:autodesk:autocad_map_3d:*:*:*:*:*:*:*:*
autodeskautocad_mechanical*cpe:2.3:a:autodesk:autocad_mechanical:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
autodesk	autocad	*	cpe:2.3:a:autodesk:autocad::::::macos::*
autodesk	autocad	*	cpe:2.3:a:autodesk:autocad::::::::
autodesk	autocad_advance_steel	*	cpe:2.3:a:autodesk:autocad_advance_steel::::::::
autodesk	autocad_architecture	*	cpe:2.3:a:autodesk:autocad_architecture::::::::
autodesk	autocad_civil_3d	*	cpe:2.3:a:autodesk:autocad_civil_3d::::::::
autodesk	autocad_electrical	*	cpe:2.3:a:autodesk:autocad_electrical::::::::
autodesk	autocad_lt	*	cpe:2.3:a:autodesk:autocad_lt::::::::
autodesk	autocad_lt	*	cpe:2.3:a:autodesk:autocad_lt::::::macos::*
autodesk	autocad_map_3d	*	cpe:2.3:a:autodesk:autocad_map_3d::::::::
autodesk	autocad_mechanical	*	cpe:2.3:a:autodesk:autocad_mechanical::::::::

Rows per page:

1-10 of 121

CNA Affected

[
  {
    "defaultStatus": "unknown",
    "product": "AutoCAD, Advance Steel and Civil 3D",
    "vendor": "Autodesk",
    "versions": [
      {
        "status": "affected",
        "version": "2024, 2023"
      }
    ]
  }
]

References

www.autodesk.com/trust/security-advisories/adsk-sa-2023-0018

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.002

Percentile

61.4%

JSON

Related for CVE-2023-29074