Deserialization in Autodesk Advance Steel
CVE-2019-7361
An attacker may convince a victim to open a malicious action micro (.actm) file that has serialized data, which may trigger a code execution in Autodesk Advance Steel 2018, Autodesk AutoCAD 2018, Autodesk AutoCAD Architecture 2018, Autodesk AutoCAD Electrical 2018, Autodesk AutoCAD Map 3D 2018, Autodesk AutoCAD Mechanical 2018, Autodesk AutoCAD MEP 2018, Autodesk AutoCAD P&ID 2018, Autodesk AutoCAD Plant 3D 2018, Autodesk AutoCAD LT 2018, and Autodesk Civil 3D 2018.
Vulnerability class: Insecure Deserialization
EPSS: 0.014 (69.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Autodesk Advance_steel — versions 2018
- Autodesk Autocad — versions 2018
- Autodesk Autocad_architecture — versions 2018
- Autodesk Autocad_electrical — versions 2018
- Autodesk Autocad_lt — versions 2018
- Autodesk Autocad_map_3d — versions 2018
- Autodesk Autocad_mechanical — versions 2018
- Autodesk Autocad_mep — versions 2018
- Autodesk Autocad_p\&id — versions 2018
- Autodesk Autocad_plant_3d — versions 2018
Weakness classification (CWE)
References
- psirt@autodesk.com (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2019-7361?
- CVE-2019-7361 is a high-severity vulnerability in Autodesk Advance Steel, classified under Deserialization of Untrusted Data. CVSS score: 7.8/10. Published 2019-04-09.
- How severe is CVE-2019-7361?
- High severity. CVSS v3 base score is 7.8 out of 10.