CVE-2023-29152
PTC Vuforia Studio Improper Authorization
CVE-2023-29152 is a medium vulnerability (CVSS 6.2) in Ptc Vuforia Studio, published June 7, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.45%, the 39th percentile. No source names a fixed version.
- Severity
- 6.2 MediumCVSS 3.1, CVE List
- Exploit chance
- 0.45%EPSS, 39th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
By changing the filename parameter in the request, an attacker could delete any file with the permissions of the Vuforia server account.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
Affected products
What each source reports
CVE List Score used
PTC Vuforia Studio Improper Authorization
By changing the filename parameter in the request, an attacker could delete any file with the permissions of the Vuforia server account.
- Record
CVE-2023-29152- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:N/A:H - Weakness
- CWE-285
- Updated
- 2026-11-02
EUVDEUVD-2023-32754
By changing the filename parameter in the request, an attacker could delete any file with the permissions of the Vuforia server account.
- Record
EUVD-2023-32754- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j9wg-rrpv-crp4
By changing the filename parameter in the request, an attacker could delete any file with the...
By changing the filename parameter in the request, an attacker could delete any file with the permissions of the Vuforia server account.
- Record
GHSA-j9wg-rrpv-crp4- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:N/A:H - Weakness
- CWE-285
- Updated
- 2026-11-02
NVD
By changing the filename parameter in the request, an attacker could delete any file with the permissions of the Vuforia server account.
- Record
CVE-2023-29152- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:N/A:H - CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-285
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.