CVE-2023-29168 The local Vuforia web application does not support HTTPS, and federated credentials are passed via basic authentication

Description

The local Vuforia web application does not support HTTPS, and federated credentials are passed via basic authentication.

Affected products and versions

Product	Affected versions	Fixed in
Vuforia Studio 9.9	earliest → < 9.9	9.9

Other CVEs of Vuforia Studio

The 6 CVEs of Vuforia Studio →

CVE-2023-31200 PTC Vuforia Studio does not require a token; this could allow an attacker with local access to perform a cross-site… 5.7 Medium CVE-2023-29502 Before importing a project into Vuforia, a user could modify the “resourceDirectory” attribute in the appConfig.json… 6.2 Medium CVE-2023-27881 A user could use the “Upload Resource” functionality to upload files to any location on the disk 8.0 High CVE-2023-29152 By changing the filename parameter in the request, an attacker could delete any file with the permissions of the… 6.2 Medium