Skip to content
OpenAdvisories
High ICSA-23-131-13 6 CVEs

PTC Vuforia Studio

Published May 12, 2023 · Updated May 12, 2023

Vendor: PTC Product: Vuforia Studio

Summary

Successful exploitation of these vulnerabilities could allow an attacker to view credentials, perform a cross-site request forgery attack, resend requests, or upload or delete arbitrary files.

Vulnerabilities 6

  • High 8.0
    CVE-2023-27881

    PTC Vuforia Studio Unrestricted Upload of File with Dangerous Type

    A user could use the “Upload Resource” functionality to upload files to any location on the disk.

    PTC Vuforia Studio
  • Medium 6.2
    CVE-2023-29152

    PTC Vuforia Studio Improper Authorization

    By changing the filename parameter in the request, an attacker could delete any file with the permissions of the Vuforia server account.

    PTC Vuforia Studio
  • Medium 6.2
    CVE-2023-29502

    PTC Vuforia Studio Path Traversal

    Before importing a project into Vuforia, a user could modify the “resourceDirectory” attribute in the appConfig.json file to be a different path.

    PTC Vuforia Studio
  • Medium 5.7
    CVE-2023-31200

    PTC Vuforia Studio Cross-Site Request Forgery

    PTC Vuforia Studio does not require a token; this could allow an attacker with local access to perform a cross-site request forgery attack or a replay attack.

    PTC Vuforia Studio
  • Low 3.7
    CVE-2023-29168

    PTC Vuforia Studio Insufficiently Protected Credentials

    The local Vuforia web application does not support HTTPS, and federated credentials are passed via basic authentication.

    PTC Vuforia Studio
  • Low 1.8
    CVE-2023-24476

    PTC Vuforia Studio Improper Authorization

    An attacker with local access to the machine could record the traffic, which could allow them to resend requests without the server authenticating that the user or session are valid.

    PTC Vuforia Studio

Revision history

  1. #1

    CSAF Creation Date

References