CVE-2021-40157

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-40157
A user may be tricked into opening a malicious FBX file which may exploit an Untrusted Pointer Dereference vulnerability in FBX’s Review version 1.5.0 and prior causing it to run arbitrary code on the system.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

9.3 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0001 Patch Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:autodesk:fbx_review:*:*:*:*:*:*:*:*
History

16 Jun 2022, 21:07

Type Values Removed Values Added
References (MISC) https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0001 - (MISC) https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0001 - Patch, Vendor Advisory
CWE CWE-119

03 May 2022, 16:04

Type Values Removed Values Added
CWE CWE-476 CWE-119

18 Apr 2022, 17:15

Type Values Removed Values Added
References
  • {'url': 'https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0002', 'name': 'https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0002', 'tags': ['Not Applicable'], 'refsource': 'MISC'}
  • (MISC) https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0001 -

27 Sep 2021, 19:27

Type Values Removed Values Added
CPE cpe:2.3:a:autodesk:fbx_review:*:*:*:*:*:*:*:*
CWE CWE-476
CVSS v2 : unknown
v3 : unknown 		v2 : 9.3
v3 : 7.8
References (MISC) https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0002 - (MISC) https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0002 - Not Applicable

15 Sep 2021, 15:35

Type Values Removed Values Added
New CVE
Information

Published : 2021-09-15 15:15

Updated : 2023-12-10 14:09

NVD link : CVE-2021-40157

Mitre link : CVE-2021-40157

CVE.ORG link : CVE-2021-40157

JSON object : View

Products Affected

autodesk

  • fbx_review
CWE
CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer