PT-2022-11194 · Autodesk · Autodesk Inventor

Mat Powell · Published 2022-01-25 · Updated 2022-11-16 · CVE-2021-40159

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Autodesk Inventor versions 2019 through 2022

Description The issue is related to an Information Disclosure vulnerability when parsing JT files, which, in conjunction with other vulnerabilities, may lead to code execution through maliciously crafted JT files in the context of the current process. This could potentially allow for remote code execution.

Recommendations For Autodesk Inventor versions 2019 through 2022, consider avoiding the use of JT files from untrusted sources until a patch is available. As a temporary workaround, consider restricting the parsing of JT files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2021-40159

ZDI-22-282

ZDI-22-289

Affected Products

Autodesk Inventor

References · 6

• https://osv.dev/vulnerability/CVE-2021-40159 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-22-282 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-289 · Security Note
• https://autodesk.com/trust/security-advisories/adsk-sa-2022-0002 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40159 · Security Note
• https://t.me/cvenotify/26575 · Telegram Post