« Volver al listado

CVE-2009-3576

Estado: ModificadaAlta (9.3)—💥 Exploit

Autodesk Softimage 7.x and Softimage XSI 6.x allow remote attackers to execute arbitrary JavaScript code via a scene package containing a Scene Table of Contents (aka .scntoc) file with a Script_Content element, as demonstrated by code that loads the WScript.Shell ActiveX control.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

💥 Exploits públicos

Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.

Tecnologías afectadas (2)

Autodesk — Autodesk SoftimageAutodesk — Autodesk Softimage XSI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2009-3576",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2009-11-24T17:30:00.233",
  "references": [
    {
      "url": "http://securitytracker.com/id?1023229",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.coresecurity.com/content/softimage-arbitrary-command-execution",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/508011/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/36637",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securitytracker.com/id?1023229",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.coresecurity.com/content/softimage-arbitrary-command-execution",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/508011/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/36637",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Autodesk Softimage 7.x and Softimage XSI 6.x allow remote attackers to execute arbitrary JavaScript code via a scene package containing a Scene Table of Contents (aka .scntoc) file with a Script_Content element, as demonstrated by code that loads the WScript.Shell ActiveX control."
    },
    {
      "lang": "es",
      "value": "Autodesk Softimage v7.x y Softimage XSI v6.x permite a atacantes remotos ejecutar código JavaScript de su elección a través de un paquete de escena que contiene un archivo Tabla de Contenidos de Escena (como .scntoc) con un elemento Script_Content, como queda demostrado por el código que carga el control ActiveX WScript.Shell. \r\n"
    }
  ],
  "lastModified": "2026-06-16T23:11:56.060",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:autodesk:autodesk_softimage:7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F1422CDB-EE7F-49D6-92FF-843E2DEAA2C3"
            },
            {
              "criteria": "cpe:2.3:a:autodesk:autodesk_softimage_xsi:6.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E5213DEA-5CB3-40B7-8487-D3AF555DE5B2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}