CVE-2023-24476 PTC Vuforia Studio Improper Authorization
An attacker with local access can replay traffic to bypass server authentication, allowing unauthorized request execution in PTC Vuforia Studio.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-24476?
CVE-2023-24476 is a low-severity missing authorization vulnerability in PTC Vuforia Studio, published on 7 Jun 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
An attacker with local access to the machine could record the traffic, which could allow them to resend requests without the server authenticating that the user or session are valid.
Weakness: CWE-285
Which versions are affected by CVE-2023-24476?
It affects 1 product.
Products include Ptc Vuforia Studio.
How do I fix CVE-2023-24476?
No fix has been published for CVE-2023-24476 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-24476 being exploited?
There is no known exploitation of CVE-2023-24476 in the wild and no public exploit code.
Other vulnerabilities in PTC Vuforia Studio
- CVE-2023-27881 PTC Vuforia Studio Unrestricted Upload of File with Dangerous Type
- CVE-2023-29152 PTC Vuforia Studio Improper Authorization
- CVE-2023-29502 PTC Vuforia Studio Path Traversal
- CVE-2023-31200 PTC Vuforia Studio Cross-Site Request Forgery
- CVE-2023-29168 PTC Vuforia Studio Insufficiently Protected Credentials
Sources
Also known as GHSA-3wjr-j39j-wfg8.