CVE-2023-41146 Missing authorization in Customer Portal

Medium 4.3 Published 22 Nov 2023 Updated 2 Aug 2024

Autodesk Customer Support Portal allows users to view cases created by other users within the same account due to missing authorization checks.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-41146?

CVE-2023-41146 is a medium-severity missing authorization vulnerability in Autodesk Customer Portal, published on 22 Nov 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Autodesk Customer Support Portal allows cases created by users under an account to see cases created by other users on the same account.

Which versions are affected by CVE-2023-41146?

It affects 1 product.

Products include Autodesk Customer Portal.

How do I fix CVE-2023-41146?

No fix has been published for CVE-2023-41146 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2023-41146 being exploited?

There is no known exploitation of CVE-2023-41146 in the wild and no public exploit code.

CVE-2023-41145 Missing authorization in Customer Portal Medium 5.3

Sources

Also known as GHSA-5phm-xfxq-9mgw.