5.7
Medium
CVE-2023-31200 PTC Vuforia Studio does not require a token; this could allow an attacker with local access to perform a cross-site…
Description
PTC Vuforia Studio does not require a token; this could allow an attacker with local access to perform a cross-site request forgery attack or a replay attack.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Vuforia Studio 9.9 | earliest → < 9.9 | 9.9 |
Other CVEs of Vuforia Studio
The 6 CVEs of Vuforia Studio →
CVE-2023-29502
Before importing a project into Vuforia, a user could modify the “resourceDirectory” attribute in the appConfig.json…
6.2
Medium
CVE-2023-27881
A user could use the “Upload Resource” functionality to upload files to any location on the disk
8.0
High
CVE-2023-29152
By changing the filename parameter in the request, an attacker could delete any file with the permissions of the…
6.2
Medium
CVE-2023-24476
An attacker with local access to the machine could record the traffic, which could allow them to resend requests…
1.8
Low