TI-2023-12475 CVE-2023-27881 · GHSA-cppg-gv65-39fx
PTC Vuforia Studio Unrestricted Upload of File with Dangerous Type
Priority MEDIUM 44
A user could use the “Upload Resource” functionality to upload files to any location on the disk.
PTC
Records44All Threatist records
Exploited (KEV)1In CISA KEV
CVSS critical17CVSS 9.0–10.0
CVSS high16CVSS 7.0–8.9
Exploited now
PTC records in CISA KEVComponents
Products in the NVD configurations · select one to filter the recordsRecords
6 records in Vuforia Studio · all components
TI-2023-14910 CVE-2023-31200 · GHSA-r3mv-hv6p-6m9g
PTC Vuforia Studio Cross-Site Request Forgery
Priority LOW 36
PTC Vuforia Studio does not require a token; this could allow an attacker with local access to perform a cross-site request forgery attack or a replay attack.
TI-2023-13583 CVE-2023-29152 · GHSA-j9wg-rrpv-crp4
PTC Vuforia Studio Improper Authorization
Priority LOW 36
By changing the filename parameter in the request, an attacker could delete any file with the permissions of the Vuforia server account.
TI-2023-13599 CVE-2023-29168 · GHSA-x3g4-wh65-9mx2
PTC Vuforia Studio Insufficiently Protected Credentials
Priority LOW 33
The local Vuforia web application does not support HTTPS, and federated credentials are passed via basic authentication.
TI-2023-13870 CVE-2023-29502 · GHSA-c88c-368w-5fmp
PTC Vuforia Studio Path Traversal
Priority LOW 28
Before importing a project into Vuforia, a user could modify the “resourceDirectory” attribute in the appConfig.json file to be a different path.
TI-2023-10097 CVE-2023-24476 · GHSA-3wjr-j39j-wfg8
PTC Vuforia Studio Improper Authorization
Priority LOW 15
An attacker with local access to the machine could record the traffic, which could allow them to resend requests without the server authenticating that the user or session are valid.