CVE-2023-29152 MEDIUM

CVE-2023-29152: PTC Vuforia Studio Improper Authorization

Vendor Ptc

Product Vuforia Studio

Weakness CWE-285

Published June 7, 2023

Last update January 6, 2025

View on NVD All CVEs

CVSS base score

6.2/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction Required

Confidentiality None

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:N/A:H

What the vulnerability does

01Description

By changing the filename parameter in the request, an attacker could delete any file with the permissions of the Vuforia server account.

Key dates

02Disclosure timeline

June 7, 2023 CVE published

January 6, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-29152 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/285.html

Related vulnerabilities

04Related CVE

CVE-2023-0584 VK Blocks <= 1.57.0.5 - Authenticated(Contributor+) Settings Update CVE-2026-9409 Sushmi-pal Invoice-System User Management user improper authorization CVE-2025-13085 SiteSEO – SEO Simplified <= 1.3.2 - Insecure Direct Object Reference to Sensitive Post Meta Disclosure CVE-2026-2077 yeqifu warehouse Role Management RoleController.java deleteRole improper authorization CVE-2021-31384 Junos OS: SRX Series: Under a specific device configuration an attacker can access the devices J-Web management services from any interface, regardless of security settings protecting the service