PTC Vuforia Studio Unrestricted Upload of File with Dangerous Type
CVE-2023-27881

9.9CRITICAL

Key Information:

Vendor

PTC

Status
Vuforia Studio
Vendor
CVE Published:
7 June 2023

What is CVE-2023-27881?

A flaw in the 'Upload Resource' feature of XYZ Product by ABC Vendor allows users to upload files to any directory on the server. This could potentially lead to unauthorized access to sensitive files or server compromise, emphasizing the need for secure file upload mechanisms and strict validation processes.

Affected Version(s)

Vuforia Studio 0 < 9.9

References

https://https://www.cisa.gov/news-events/ics-advisories/i...

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lockheed Martin—Red Team reported these vulnerabilities to PTC.
.