XXE in Autodesk Fusion 360
CVE-2022-27873
An attacker can force the victim’s device to perform arbitrary HTTP requests in WAN through a malicious SVG file being parsed by Autodesk Fusion 360’s document parser. The vulnerability exists in the application’s ‘Insert SVG’ procedure. An attacker can also leverage this vulnerability to obtain victim’s public IP and possibly other sensitive information.
Vulnerability class: XXE (XML External Entity)
EPSS: 0.002 (11.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Autodesk Fusion_360
- N/a Fusion360 — versions 2.0.12887 and prior
Weakness classification (CWE)
References
- psirt@autodesk.com (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2022-27873?
- CVE-2022-27873 is a high-severity vulnerability in Autodesk Fusion 360, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 7.8/10. Published 2022-07-29.
- How severe is CVE-2022-27873?
- High severity. CVSS v3 base score is 7.8 out of 10.