CVE-2023-41139

A maliciously crafted STP file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to dereference an untrusted pointer. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0018	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:autodesk:autocad::::::macos::*
	cpe:2.3:a:autodesk:autocad::::::::
	cpe:2.3:a:autodesk:autocad::::::::
	cpe:2.3:a:autodesk:autocad_advance_steel::::::::
	cpe:2.3:a:autodesk:autocad_advance_steel::::::::
	cpe:2.3:a:autodesk:autocad_architecture::::::::
	cpe:2.3:a:autodesk:autocad_architecture::::::::
	cpe:2.3:a:autodesk:autocad_civil_3d::::::::
	cpe:2.3:a:autodesk:autocad_civil_3d::::::::
	cpe:2.3:a:autodesk:autocad_electrical::::::::
	cpe:2.3:a:autodesk:autocad_electrical::::::::
	cpe:2.3:a:autodesk:autocad_lt::::::::
	cpe:2.3:a:autodesk:autocad_lt::::::macos::*
	cpe:2.3:a:autodesk:autocad_lt::::::::
	cpe:2.3:a:autodesk:autocad_map_3d::::::::
	cpe:2.3:a:autodesk:autocad_map_3d::::::::
	cpe:2.3:a:autodesk:autocad_mechanical::::::::
	cpe:2.3:a:autodesk:autocad_mechanical::::::::
	cpe:2.3:a:autodesk:autocad_mep::::::::
	cpe:2.3:a:autodesk:autocad_mep::::::::
	cpe:2.3:a:autodesk:autocad_plant_3d::::::::
	cpe:2.3:a:autodesk:autocad_plant_3d::::::::

History

No history.

Information

Published : 2023-11-23 04:15

Updated : 2023-11-30 15:48

NVD link : CVE-2023-41139

Mitre link : CVE-2023-41139

CVE.ORG link : CVE-2023-41139

JSON object : View

Products Affected

autodesk

autocad
autocad_mep
autocad_plant_3d
autocad_mechanical
autocad_civil_3d
autocad_advance_steel
autocad_map_3d
autocad_architecture
autocad_electrical
autocad_lt

CWE

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-822

Untrusted Pointer Dereference

{"id": "CVE-2023-41139", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2023-11-23T04:15:07.467", "references": [{"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0018", "tags": ["Vendor Advisory"], "source": "psirt@autodesk.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-119"}]}, {"type": "Secondary", "source": "psirt@autodesk.com", "description": [{"lang": "en", "value": "CWE-822"}]}], "descriptions": [{"lang": "en", "value": "A maliciously crafted STP file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to dereference an untrusted pointer. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.\n"}, {"lang": "es", "value": "Un archivo STP creado con fines malintencionados, cuando se analiza mediante Autodesk AutoCAD 2024 y 2023, se puede utilizar para eliminar la referencia a un puntero que no es de confianza. Esta vulnerabilidad, junto con otras vulnerabilidades, podr\u00eda provocar la ejecuci\u00f3n de c\u00f3digo en el proceso actual."}], "lastModified": "2023-11-30T15:48:23.633", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:autodesk:autocad:*:*:*:*:*:macos:*:*", "vulnerable": true, "matchCriteriaId": "A383FEED-E3E3-405E-B68F-BFD7CCA9E6B8", "versionEndExcluding": "2024.1"}, {"criteria": "cpe:2.3:a:autodesk:autocad:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C53280C1-2A72-455E-965C-06613E469420", "versionEndExcluding": "2023.1.4", "versionStartIncluding": "2023.0.0"}, {"criteria": "cpe:2.3:a:autodesk:autocad:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "417B7F6E-18F2-4020-84B4-55191714504F", "versionEndExcluding": "2024.1.1", "versionStartIncluding": "2024.0.0"}, {"criteria": "cpe:2.3:a:autodesk:autocad_advance_steel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3C1B51F8-FACC-422B-AB62-571C8534279C", "versionEndExcluding": "2023.1.4"}, {"criteria": "cpe:2.3:a:autodesk:autocad_advance_steel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5D5A59C7-068D-4F8D-95ED-B7A5F2AA55F8", "versionEndExcluding": "2024.1.1", "versionStartIncluding": "2024.0.0"}, {"criteria": "cpe:2.3:a:autodesk:autocad_architecture:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3524F041-03B7-46A6-AB92-4AA59DD79903", "versionEndExcluding": "2023.1.4"}, {"criteria": "cpe:2.3:a:autodesk:autocad_architecture:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4036CA65-3E98-43B5-95D4-7AC1E5345664", "versionEndExcluding": "2024.1.1", "versionStartIncluding": "2024.0.0"}, {"criteria": "cpe:2.3:a:autodesk:autocad_civil_3d:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A0DE2E5C-0C3B-4E25-B380-ABFBFC34B9D9", "versionEndExcluding": "2023.1.4"}, {"criteria": "cpe:2.3:a:autodesk:autocad_civil_3d:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "982AD391-3D1B-4923-97A5-B2AA41BE2CAC", "versionEndExcluding": "2024.1.1", "versionStartIncluding": "2024.0.0"}, {"criteria": "cpe:2.3:a:autodesk:autocad_electrical:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "80BDD7F9-1D15-4D35-9726-C931BCEE5F05", "versionEndExcluding": "2023.1.4"}, {"criteria": "cpe:2.3:a:autodesk:autocad_electrical:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "77484E5B-F84E-472E-B151-53FF2667C783", "versionEndExcluding": "2024.1.1", "versionStartIncluding": "2024.0.0"}, {"criteria": "cpe:2.3:a:autodesk:autocad_lt:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "96B75F1C-FFBB-4B13-8F05-4D7B26F4C58C", "versionEndExcluding": "2023.1.4"}, {"criteria": "cpe:2.3:a:autodesk:autocad_lt:*:*:*:*:*:macos:*:*", "vulnerable": true, "matchCriteriaId": "D5B21F42-E57A-4501-A2BE-6F99122BCBFC", "versionEndExcluding": "2024.1"}, {"criteria": "cpe:2.3:a:autodesk:autocad_lt:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2225348E-5552-492C-A2DB-C5693516019C", "versionEndExcluding": "2024.1.1", "versionStartIncluding": "2024.0.0"}, {"criteria": "cpe:2.3:a:autodesk:autocad_map_3d:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5B450512-9CB3-4CAF-B90C-1EE0194CA665", "versionEndExcluding": "2023.1.4"}, {"criteria": "cpe:2.3:a:autodesk:autocad_map_3d:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2A778F8B-9BB9-4B7A-81B1-DCEDCB493408", "versionEndExcluding": "2024.1.1", "versionStartIncluding": "2024.0.0"}, {"criteria": "cpe:2.3:a:autodesk:autocad_mechanical:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "049B25B6-08E3-4D3D-8E7B-3724B53063F0", "versionEndExcluding": "2023.1.4"}, {"criteria": "cpe:2.3:a:autodesk:autocad_mechanical:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7A8BF172-C18C-40D3-8917-6C33D0144D3E", "versionEndExcluding": "2024.1.1", "versionStartIncluding": "2024.0.0"}, {"criteria": "cpe:2.3:a:autodesk:autocad_mep:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BC4656EC-02E1-41DF-8FEA-668DE950FA79", "versionEndExcluding": "2023.1.4"}, {"criteria": "cpe:2.3:a:autodesk:autocad_mep:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "67E135A2-2C3E-4550-B239-3013C7FA586A", "versionEndExcluding": "2024.1.1", "versionStartIncluding": "2024.0.0"}, {"criteria": "cpe:2.3:a:autodesk:autocad_plant_3d:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AFDAEB3D-CDF1-4E2F-B1D5-6D4140E8A65C", "versionEndExcluding": "2023.1.4"}, {"criteria": "cpe:2.3:a:autodesk:autocad_plant_3d:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5CB26133-E6B9-4D0C-9A58-F564FFB11EF3", "versionEndExcluding": "2024.1.1", "versionStartIncluding": "2024.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@autodesk.com"}