RCE in Autodesk Softimage
CVE-2009-3576
Autodesk Softimage 7.x and Softimage XSI 6.x allow remote attackers to execute arbitrary JavaScript code via a scene package containing a Scene Table of Contents (aka .scntoc) file with a Script_Content element, as demonstrated by code that loads the WScript.Shell ActiveX control.
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.032 (86.7th percentile) — read the EPSS interpretation.
Affected products
- Autodesk Autodesk_softimage — versions 7.0
- Autodesk Autodesk_softimage_xsi — versions 6.0
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (Exploit, x_refsource_MISC)
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
- cve@mitre.org (vdb-entry, x_refsource_SECTRACK)
- cve@mitre.org (vdb-entry, x_refsource_BID)