CVE-2022-25788 - Vulnerability Details

Vendors	Products
Autodesk	Advance Steel Autocad Autocad Architecture Autocad Electrical Autocad Lt Autocad Map 3d Autocad Mechanical Autocad Mep Autocad Plant 3d Civil 3d Inventor

Link	Providers
https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0002

Show plain JSON

{"containers": {"cna": {"affected": [{"product": "Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D", "vendor": "n/a", "versions": [{"status": "affected", "version": "2022.1.1"}]}], "descriptions": [{"lang": "en", "value": "A maliciously crafted JT file in Autodesk AutoCAD 2022 may be used to write beyond the allocated buffer while parsing JT files. This vulnerability can be exploited to execute arbitrary code."}], "problemTypes": [{"descriptions": [{"description": "Out-of-bound Write", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-04-19T20:26:31", "orgId": "7e40ea87-bc65-4944-9723-dd79dd760601", "shortName": "autodesk"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0002"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@autodesk.com", "ID": "CVE-2022-25788", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D", "version": {"version_data": [{"version_value": "2022.1.1"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A maliciously crafted JT file in Autodesk AutoCAD 2022 may be used to write beyond the allocated buffer while parsing JT files. This vulnerability can be exploited to execute arbitrary code."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Out-of-bound Write"}]}]}, "references": {"reference_data": [{"name": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0002", "refsource": "MISC", "url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0002"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T04:49:43.514Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0002"}]}]}, "cveMetadata": {"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601", "assignerShortName": "autodesk", "cveId": "CVE-2022-25788", "datePublished": "2022-04-19T20:26:31", "dateReserved": "2022-02-22T00:00:00", "dateUpdated": "2024-08-03T04:49:43.514Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{

containers : { »

cna : { »

affected : [ »

0 : { »

product : Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D (string)

vendor : n/a (string)

versions : [ »

0 : { »

status : affected (string)

version : 2022.1.1 (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : A maliciously crafted JT file in Autodesk AutoCAD 2022 may be used to write beyond the allocated buffer while parsing JT files. This vulnerability can be exploited to execute arbitrary code. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

description : Out-of-bound Write (string)

lang : en (string)

type : text (string)

}

]

}

]

providerMetadata : { »

dateUpdated : 2022-04-19T20:26:31 (string)

orgId : 7e40ea87-bc65-4944-9723-dd79dd760601 (string)

shortName : autodesk (string)

}

references : [ »

0 : { »

tags : [ »

0 : x_refsource_MISC (string)

]

url : https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0002 (string)

}

]

x_legacyV4Record : { »

CVE_data_meta : { »

ASSIGNER : psirt@autodesk.com (string)

ID : CVE-2022-25788 (string)

STATE : PUBLIC (string)

}

affects : { »

vendor : { »

vendor_data : [ »

0 : { »

product : { »

product_data : [ »

0 : { »

product_name : Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D (string)

version : { »

version_data : [ »

0 : { »

version_value : 2022.1.1 (string)

}

]

}

]

}

vendor_name : n/a (string)

}

]

}

data_format : MITRE (string)

data_type : CVE (string)

data_version : 4.0 (string)

description : { »

description_data : [ »

0 : { »

lang : eng (string)

value : A maliciously crafted JT file in Autodesk AutoCAD 2022 may be used to write beyond the allocated buffer while parsing JT files. This vulnerability can be exploited to execute arbitrary code. (string)

}

]

}

problemtype : { »

problemtype_data : [ »

0 : { »

description : [ »

0 : { »

lang : eng (string)

value : Out-of-bound Write (string)

}

]

}

]

}

references : { »

reference_data : [ »

0 : { »

name : https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0002 (string)

refsource : MISC (string)

url : https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0002 (string)

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-03T04:49:43.514Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

tags : [ »

0 : x_refsource_MISC (string)

1 : x_transferred (string)

]

url : https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0002 (string)

}

]

}

]

}

cveMetadata : { »

assignerOrgId : 7e40ea87-bc65-4944-9723-dd79dd760601 (string)

assignerShortName : autodesk (string)

cveId : CVE-2022-25788 (string)

datePublished : 2022-04-19T20:26:31 (string)

dateReserved : 2022-02-22T00:00:00 (string)

dateUpdated : 2024-08-03T04:49:43.514Z (string)

state : PUBLISHED (string)

}

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:autodesk:advance_steel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E1BE9431-DC86-4ABB-8EE2-9FADA3B0AEBA", "versionEndExcluding": "2022.1.2", "versionStartIncluding": "2022", "vulnerable": true}, {"criteria": "cpe:2.3:a:autodesk:autocad:*:*:*:*:*:-:*:*", "matchCriteriaId": "E3116E10-FB93-4EC7-957E-B130FE5153BF", "versionEndExcluding": "2022.1.2", "versionStartIncluding": "2022", "vulnerable": true}, {"criteria": "cpe:2.3:a:autodesk:autocad:*:*:*:*:*:macos:*:*", "matchCriteriaId": "8357611C-929E-407C-B4C8-6ED926E513C6", "versionEndExcluding": "2022.2.2", "versionStartIncluding": "2022", "vulnerable": true}, {"criteria": "cpe:2.3:a:autodesk:autocad_architecture:*:*:*:*:*:*:*:*", "matchCriteriaId": "E9466EE6-83C9-492F-8486-F3E6C1DD9F5A", "versionEndExcluding": "2022.1.2", "versionStartIncluding": "2022", "vulnerable": true}, {"criteria": "cpe:2.3:a:autodesk:autocad_electrical:*:*:*:*:*:*:*:*", "matchCriteriaId": "6DD91E39-A3D8-4806-A778-608FD6C29BB2", "versionEndExcluding": "2022.1.2", "versionStartIncluding": "2022", "vulnerable": true}, {"criteria": "cpe:2.3:a:autodesk:autocad_lt:*:*:*:*:*:-:*:*", "matchCriteriaId": "0DC17B10-E6E8-4D49-BDEF-DBC5097580C9", "versionEndExcluding": "2022.1.2", "versionStartIncluding": "2022", "vulnerable": true}, {"criteria": "cpe:2.3:a:autodesk:autocad_lt:*:*:*:*:*:macos:*:*", "matchCriteriaId": "EEC464C9-D741-41B4-B460-B4305BCD83FA", "versionEndExcluding": "2022.2.2", "versionStartIncluding": "2022", "vulnerable": true}, {"criteria": "cpe:2.3:a:autodesk:autocad_map_3d:*:*:*:*:*:*:*:*", "matchCriteriaId": "120326C3-E212-4341-A25D-BC3DD50CF228", "versionEndExcluding": "2022.1.2", "versionStartIncluding": "2022", "vulnerable": true}, {"criteria": "cpe:2.3:a:autodesk:autocad_mechanical:*:*:*:*:*:*:*:*", "matchCriteriaId": "B117299A-C5FE-419F-9C1C-DF58A2772055", "versionEndExcluding": "2022.1.2", "versionStartIncluding": "2022", "vulnerable": true}, {"criteria": "cpe:2.3:a:autodesk:autocad_mep:*:*:*:*:*:*:*:*", "matchCriteriaId": "CC178212-E440-46E9-9F00-60A5516D4D72", "versionEndExcluding": "2022.1.2", "versionStartIncluding": "2022", "vulnerable": true}, {"criteria": "cpe:2.3:a:autodesk:autocad_plant_3d:*:*:*:*:*:*:*:*", "matchCriteriaId": "7ED0DB1D-6F37-4C1B-B55E-42F3A4E34299", "versionEndExcluding": "2022.1.2", "versionStartIncluding": "2022", "vulnerable": true}, {"criteria": "cpe:2.3:a:autodesk:civil_3d:*:*:*:*:*:*:*:*", "matchCriteriaId": "82C21398-6A86-4E56-A98E-E80FFCC6732E", "versionEndExcluding": "2022.1.2", "versionStartIncluding": "2022", "vulnerable": true}, {"criteria": "cpe:2.3:a:autodesk:inventor:*:*:*:*:*:*:*:*", "matchCriteriaId": "D53B7E4C-4F2E-428D-A6CB-D4F2FB5865B0", "versionEndExcluding": "2022.2", "versionStartIncluding": "2022", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A maliciously crafted JT file in Autodesk AutoCAD 2022 may be used to write beyond the allocated buffer while parsing JT files. This vulnerability can be exploited to execute arbitrary code."}, {"lang": "es", "value": "Un archivo JT malicioso en Autodesk AutoCAD versi\u00f3n 2022 puede usarse para escribir m\u00e1s all\u00e1 del b\u00fafer asignado mientras son analizados los archivos JT. Esta vulnerabilidad puede ser explotada para ejecutar c\u00f3digo arbitrario"}], "id": "CVE-2022-25788", "lastModified": "2024-11-21T06:53:00.200", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-04-19T21:15:18.650", "references": [{"source": "psirt@autodesk.com", "tags": ["Vendor Advisory"], "url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0002"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0002"}], "sourceIdentifier": "psirt@autodesk.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:autodesk:advance_steel:*:*:*:*:*:*:*:* (string)

matchCriteriaId : E1BE9431-DC86-4ABB-8EE2-9FADA3B0AEBA (string)

versionEndExcluding : 2022.1.2 (string)

versionStartIncluding : 2022 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:autodesk:autocad:*:*:*:*:*:-:*:* (string)

matchCriteriaId : E3116E10-FB93-4EC7-957E-B130FE5153BF (string)

versionEndExcluding : 2022.1.2 (string)

versionStartIncluding : 2022 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:autodesk:autocad:*:*:*:*:*:macos:*:* (string)

matchCriteriaId : 8357611C-929E-407C-B4C8-6ED926E513C6 (string)

versionEndExcluding : 2022.2.2 (string)

versionStartIncluding : 2022 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:autodesk:autocad_architecture:*:*:*:*:*:*:*:* (string)

matchCriteriaId : E9466EE6-83C9-492F-8486-F3E6C1DD9F5A (string)

versionEndExcluding : 2022.1.2 (string)

versionStartIncluding : 2022 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:autodesk:autocad_electrical:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 6DD91E39-A3D8-4806-A778-608FD6C29BB2 (string)

versionEndExcluding : 2022.1.2 (string)

versionStartIncluding : 2022 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:autodesk:autocad_lt:*:*:*:*:*:-:*:* (string)

matchCriteriaId : 0DC17B10-E6E8-4D49-BDEF-DBC5097580C9 (string)

versionEndExcluding : 2022.1.2 (string)

versionStartIncluding : 2022 (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:autodesk:autocad_lt:*:*:*:*:*:macos:*:* (string)

matchCriteriaId : EEC464C9-D741-41B4-B460-B4305BCD83FA (string)

versionEndExcluding : 2022.2.2 (string)

versionStartIncluding : 2022 (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:autodesk:autocad_map_3d:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 120326C3-E212-4341-A25D-BC3DD50CF228 (string)

versionEndExcluding : 2022.1.2 (string)

versionStartIncluding : 2022 (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:autodesk:autocad_mechanical:*:*:*:*:*:*:*:* (string)

matchCriteriaId : B117299A-C5FE-419F-9C1C-DF58A2772055 (string)

versionEndExcluding : 2022.1.2 (string)

versionStartIncluding : 2022 (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:autodesk:autocad_mep:*:*:*:*:*:*:*:* (string)

matchCriteriaId : CC178212-E440-46E9-9F00-60A5516D4D72 (string)

versionEndExcluding : 2022.1.2 (string)

versionStartIncluding : 2022 (string)

vulnerable : true (boolean)

}

10 : { »

criteria : cpe:2.3:a:autodesk:autocad_plant_3d:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 7ED0DB1D-6F37-4C1B-B55E-42F3A4E34299 (string)

versionEndExcluding : 2022.1.2 (string)

versionStartIncluding : 2022 (string)

vulnerable : true (boolean)

}

11 : { »

criteria : cpe:2.3:a:autodesk:civil_3d:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 82C21398-6A86-4E56-A98E-E80FFCC6732E (string)

versionEndExcluding : 2022.1.2 (string)

versionStartIncluding : 2022 (string)

vulnerable : true (boolean)

}

12 : { »

criteria : cpe:2.3:a:autodesk:inventor:*:*:*:*:*:*:*:* (string)

matchCriteriaId : D53B7E4C-4F2E-428D-A6CB-D4F2FB5865B0 (string)

versionEndExcluding : 2022.2 (string)

versionStartIncluding : 2022 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : A maliciously crafted JT file in Autodesk AutoCAD 2022 may be used to write beyond the allocated buffer while parsing JT files. This vulnerability can be exploited to execute arbitrary code. (string)

}

1 : { »

lang : es (string)

value : Un archivo JT malicioso en Autodesk AutoCAD versión 2022 puede usarse para escribir más allá del búfer asignado mientras son analizados los archivos JT. Esta vulnerabilidad puede ser explotada para ejecutar código arbitrario (string)

}

]

id : CVE-2022-25788 (string)

lastModified : 2024-11-21T06:53:00.200 (string)

metrics : { »

cvssMetricV2 : [ »

0 : { »

acInsufInfo : false (boolean)

baseSeverity : MEDIUM (string)

cvssData : { »

accessComplexity : MEDIUM (string)

accessVector : NETWORK (string)

authentication : NONE (string)

availabilityImpact : PARTIAL (string)

baseScore : 6.8 (number)

confidentialityImpact : PARTIAL (string)

integrityImpact : PARTIAL (string)

vectorString : AV:N/AC:M/Au:N/C:P/I:P/A:P (string)

version : 2.0 (string)

}

exploitabilityScore : 8.6 (number)

impactScore : 6.4 (number)

obtainAllPrivilege : false (boolean)

obtainOtherPrivilege : false (boolean)

obtainUserPrivilege : false (boolean)

source : nvd@nist.gov (string)

type : Primary (string)

userInteractionRequired : true (boolean)

}

]

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : LOCAL (string)

availabilityImpact : HIGH (string)

baseScore : 7.8 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 1.8 (number)

impactScore : 5.9 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2022-04-19T21:15:18.650 (string)

references : [ »

0 : { »

source : psirt@autodesk.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0002 (string)

}

1 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0002 (string)

}

]

sourceIdentifier : psirt@autodesk.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-787 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Affected Vendors & Products

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object