CVE-2022-25794

An Out-Of-Bounds Read Vulnerability in Autodesk FBX Review version 1.5.2 and prior may lead to code execution through maliciously crafted ActionScript Byte Code 'ABC' files or information disclosure. ABC files are created by the Flash compiler and contain executable code. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.

CVSS v3 7.8 HIGH
CVSS v2.0 6.8 MEDIUM

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0006	Vendor Advisory
https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0006	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:autodesk:fbx_review:*:*:*:*:*:*:*:*

History

21 Nov 2024, 06:53

Type	Values Removed	Values Added
References	~~() https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0006 - Vendor Advisory~~	() https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0006 - Vendor Advisory

Information

Published : 2022-04-11 20:15

Updated : 2024-11-21 06:53

NVD link : CVE-2022-25794

Mitre link : CVE-2022-25794

CVE.ORG link : CVE-2022-25794

JSON object : View

Products Affected

autodesk

fbx_review

CWE

CWE-125

Out-of-bounds Read

{"id": "CVE-2022-25794", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2022-04-11T20:15:20.630", "references": [{"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0006", "tags": ["Vendor Advisory"], "source": "psirt@autodesk.com"}, {"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0006", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "An Out-Of-Bounds Read Vulnerability in Autodesk FBX Review version 1.5.2 and prior may lead to code execution through maliciously crafted ActionScript Byte Code 'ABC' files or information disclosure. ABC files are created by the Flash compiler and contain executable code. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process."}, {"lang": "es", "value": "Una vulnerabilidad de lectura fuera de los l\u00edmites en la versi\u00f3n 1.5.2 de Autodesk FBX Review y anteriores puede conducir a la ejecuci\u00f3n de c\u00f3digo a trav\u00e9s de archivos ActionScript Byte Code 'ABC' maliciosamente elaborados o a la divulgaci\u00f3n de informaci\u00f3n. Los archivos ABC son creados por el compilador de Flash y contienen c\u00f3digo ejecutable. Esta vulnerabilidad, junto con otras, podr\u00eda conducir a la ejecuci\u00f3n de c\u00f3digo en el contexto del proceso actual"}], "lastModified": "2024-11-21T06:53:00.900", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:autodesk:fbx_review:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D3620231-3E77-41DB-BDC3-D2150403BF4D", "versionEndExcluding": "1.5.3"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@autodesk.com"}