CVE-2021-40159CWE-200information-disclosure

CVE-2021-40159

High · published January 26, 2022

CVSS v3.1
7.8
EPSS
2%
Percentile
83.1
In the wild
Unconfirmed
What it is

An Information Disclosure vulnerability for JT files in Autodesk Inventor 2022, 2021, 2020, 2019 in conjunction with other vulnerabilities may lead to code execution through maliciously crafted JT files in the context of the current process.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02296 · 83.1th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2022-01-26T01:15Z
Affected products (14)
ProductVersionsFixed in
autodesk/advance_steel≥ 2022, < 2022.1.22022.1.2
autodesk/autocad≥ 2022, < 2022.1.22022.1.2
autodesk/autocad_architecture≥ 2022, < 2022.1.22022.1.2
autodesk/autocad_electrical≥ 2022, < 2022.1.22022.1.2
autodesk/autocad_lt≥ 2022, < 2022.1.22022.1.2
autodesk/autocad_map_3d≥ 2022, < 2022.1.22022.1.2
autodesk/autocad_mechanical≥ 2022, < 2022.1.22022.1.2
autodesk/autocad_mep≥ 2022, < 2022.1.22022.1.2
autodesk/autocad_plant_3d≥ 2022, < 2022.1.22022.1.2
autodesk/civil_3d≥ 2022, < 2022.1.22022.1.2
autodesk/inventorall versions—
autodesk/inventorall versions—
autodesk/inventorall versions—
autodesk/inventorall versions—
References (6)
https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0002 · [email protected]https://www.zerodayinitiative.com/advisories/ZDI-22-282/ · [email protected]https://www.zerodayinitiative.com/advisories/ZDI-22-289/ · [email protected]https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0002 · af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-282/ · af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-289/ · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 25 JAN 00:00Z
    An Information Disclosure vulnerability for JT files in Autodesk Inventor 2022, 2021, 2020, 2019 in conjunction with other vulnerabilities may lead to code…
    cvelistv5