CVE-2023-41139

A maliciously crafted STP file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to dereference an untrusted pointer. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.

CVSS v3.0 7.8 HIGH

7.8^/10

CVSS v3.0 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0018	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:autodesk:autocad_map_3d::::::::
	cpe:2.3:a:autodesk:autocad_map_3d::::::::
	cpe:2.3:a:autodesk:autocad_electrical::::::::
	cpe:2.3:a:autodesk:autocad_electrical::::::::
	cpe:2.3:a:autodesk:autocad::::::::
	cpe:2.3:a:autodesk:autocad::::::::
	cpe:2.3:a:autodesk:autocad_architecture::::::::
	cpe:2.3:a:autodesk:autocad_architecture::::::::
	cpe:2.3:a:autodesk:autocad_lt::::::macos::*
	cpe:2.3:a:autodesk:autocad::::::macos::*
	cpe:2.3:a:autodesk:autocad_lt::::::::
	cpe:2.3:a:autodesk:autocad_lt::::::::
	cpe:2.3:a:autodesk:autocad_civil_3d::::::::
	cpe:2.3:a:autodesk:autocad_civil_3d::::::::
	cpe:2.3:a:autodesk:autocad_advance_steel::::::::
	cpe:2.3:a:autodesk:autocad_advance_steel::::::::
	cpe:2.3:a:autodesk:autocad_plant_3d::::::::
	cpe:2.3:a:autodesk:autocad_plant_3d::::::::
	cpe:2.3:a:autodesk:autocad_mep::::::::
	cpe:2.3:a:autodesk:autocad_mep::::::::
	cpe:2.3:a:autodesk:autocad_mechanical::::::::
	cpe:2.3:a:autodesk:autocad_mechanical::::::::

Information

Published : 2023-11-23 04:15

Updated : 2023-11-30 15:48

NVD link : CVE-2023-41139

Mitre link : CVE-2023-41139

JSON object : View

Products Affected

autodesk

autocad_lt
autocad_architecture
autocad_electrical
autocad_plant_3d
autocad_advance_steel
autocad_map_3d
autocad_mechanical
autocad_mep
autocad
autocad_civil_3d

CWE

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0018", "name": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0018", "tags": ["Vendor Advisory"], "refsource": ""}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "A maliciously crafted STP file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to dereference an untrusted pointer. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.\n"}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-119"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2023-41139", "ASSIGNER": "psirt@autodesk.com"}}, "impact": {"baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}}, "publishedDate": "2023-11-23T04:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:autodesk:autocad_map_3d:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "2023.1.4"}, {"cpe23Uri": "cpe:2.3:a:autodesk:autocad_map_3d:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "2024.1.1", "versionStartIncluding": "2024.0.0"}, {"cpe23Uri": "cpe:2.3:a:autodesk:autocad_electrical:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "2023.1.4"}, {"cpe23Uri": "cpe:2.3:a:autodesk:autocad_electrical:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "2024.1.1", "versionStartIncluding": "2024.0.0"}, {"cpe23Uri": "cpe:2.3:a:autodesk:autocad:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "2024.1.1", "versionStartIncluding": "2024.0.0"}, {"cpe23Uri": "cpe:2.3:a:autodesk:autocad:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "2023.1.4", "versionStartIncluding": "2023.0.0"}, {"cpe23Uri": "cpe:2.3:a:autodesk:autocad_architecture:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "2024.1.1", "versionStartIncluding": "2024.0.0"}, {"cpe23Uri": "cpe:2.3:a:autodesk:autocad_architecture:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "2023.1.4"}, {"cpe23Uri": "cpe:2.3:a:autodesk:autocad_lt:*:*:*:*:*:macos:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "2024.1"}, {"cpe23Uri": "cpe:2.3:a:autodesk:autocad:*:*:*:*:*:macos:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "2024.1"}, {"cpe23Uri": "cpe:2.3:a:autodesk:autocad_lt:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "2023.1.4"}, {"cpe23Uri": "cpe:2.3:a:autodesk:autocad_lt:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "2024.1.1", "versionStartIncluding": "2024.0.0"}, {"cpe23Uri": "cpe:2.3:a:autodesk:autocad_civil_3d:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "2023.1.4"}, {"cpe23Uri": "cpe:2.3:a:autodesk:autocad_civil_3d:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "2024.1.1", "versionStartIncluding": "2024.0.0"}, {"cpe23Uri": "cpe:2.3:a:autodesk:autocad_advance_steel:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "2023.1.4"}, {"cpe23Uri": "cpe:2.3:a:autodesk:autocad_advance_steel:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "2024.1.1", "versionStartIncluding": "2024.0.0"}, {"cpe23Uri": "cpe:2.3:a:autodesk:autocad_plant_3d:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "2023.1.4"}, {"cpe23Uri": "cpe:2.3:a:autodesk:autocad_plant_3d:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "2024.1.1", "versionStartIncluding": "2024.0.0"}, {"cpe23Uri": "cpe:2.3:a:autodesk:autocad_mep:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "2023.1.4"}, {"cpe23Uri": "cpe:2.3:a:autodesk:autocad_mep:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "2024.1.1", "versionStartIncluding": "2024.0.0"}, {"cpe23Uri": "cpe:2.3:a:autodesk:autocad_mechanical:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "2023.1.4"}, {"cpe23Uri": "cpe:2.3:a:autodesk:autocad_mechanical:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "2024.1.1", "versionStartIncluding": "2024.0.0"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2023-11-30T15:48Z"}