Medium severity · published Nov 22, 2023
CVE-2023-41146
Autodesk Customer Support Portal allows cases created by users under an account to see cases created by other users on the same account
4.3
CVSS
0.5%
EPSS
No
On KEV
Description
Autodesk Customer Support Portal allows cases created by users under an account to see cases created by other users on the same account.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CP
Customer Portal · Autodesk
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-41146
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-41146
Vendor Advisory
https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0020
More from Customer Portal
5.3
CVE-2023-41145
Autodesk users who no longer have an active license for an account can still access cases for that account