7.8high
CVE-2019-7364
DLL preloading vulnerability in versions 2017, 2018, 2019, and 2020 of Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Arch…
Published 7 y ago · modified 6 d ago · JSON
CVSS
7.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.9%
percentile 80%
Public exploits
0
none known
Summary
DLL preloading vulnerability in versions 2017, 2018, 2019, and 2020 of Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D and version 2017 of AutoCAD P&ID. An attacker may trick a user into opening a malicious DWG file that may leverage a DLL preloading vulnerability in AutoCAD which may result in code execution.
CISA SSVC assessment
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 6 d ago
Exploit prediction (EPSS)
1.89% probability of exploitation in the next 30 days, higher than 80% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 7.8 | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Affected products
- n/a Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, AutoCAD P&ID
Classification
- Weakness
- CWE-427 Uncontrolled Search Path Element
References
- autodesk.com /trust/security-advisories/adsk-sa-2019-0002 · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2019-7364
- NVD: CVE-2019-7364
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.