File Access Vulnerability in Newforma Info Exchange
CVE-2025-35053

6.1MEDIUM

Key Information:

Vendor

Newforma

Status
Project Center
Vendor
CVE Published:
9 October 2025

What is CVE-2025-35053?

A vulnerability in Newforma Info Exchange allows authenticated users to execute file read and delete commands via the '/UserWeb/Common/MarkupServices.ashx' endpoint, with 'NT AUTHORITY\NetworkService' privileges. The issue arises from the default setting that enables anonymous access, which can be exploited by unauthenticated attackers. This can lead to unauthorized exposure or deletion of sensitive files.

Affected Version(s)

Project Center *

Project Center 2024.3

References

https://www.cve.org/CVERecord?id=CVE-2025-35062
https://raw.githubusercontent.com/cisagov/CSAF/develop/cs...
https://www.cve.org/CVERecord?id=CVE-2025-35053

CVSS V4

Score:
6.1
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Shadron Gudmunson,Luke Rindels,Robert McCain,Asjha Stus,Adam Merrill,Ryan Kao,Brian Healy, Sandia National Laboratories Adversarial Modeling and Penetration Testing (AMPT)
JSON
.
CVE-2025-35053 : File Access Vulnerability in Newforma Info Exchange