Login Request a demo
Low severity · published Jun 7, 2023
CVE-2023-24476
An attacker with local access to the machine could record the traffic, which could allow them to resend requests without the server authenticating that the user or session are…
3.3
CVSS
0.1%
EPSS
No
On KEV
Description
An attacker with local access to the machine could record the traffic, which could allow them to resend requests without the server authenticating that the user or session are valid.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VS
Vuforia Studio · Ptc
before 9.9 · source: NVD
Affected product
VS
Vuforia Studio
Ptc
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-24476
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-24476
Broken Link
https://https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-13
Third Party Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-13
More from Vuforia Studio
9.9
CVE-2023-27881
A user could use the “Upload Resource” functionality to upload files to any location on the disk
8.1
CVE-2023-29152
By changing the filename parameter in the request, an attacker could delete any file with the permissions of the Vuforia server account
8.0
CVE-2023-31200
PTC Vuforia Studio does not require a token; this could allow an attacker with local access to perform a cross-site request forgery attack or a replay attack
7.5
CVE-2023-29168
The local Vuforia web application does not support HTTPS, and federated credentials are passed via basic authentication
4.3
CVE-2023-29502
Before importing a project into Vuforia, a user could modify the “resourceDirectory” attribute in the appConfig.json file to be a different path