« Volver al listado

CVE-2021-27030

Estado: ModificadaAlta (7.8)—

A user may be tricked into opening a malicious FBX file which may exploit a Directory Traversal Remote Code Execution vulnerability in FBX’s Review causing it to run arbitrary code on the system.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Autodesk — FBX Review

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-27030",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@autodesk.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Autodesk FBX Review",
          "versions": [
            {
              "status": "affected",
              "version": "1.4.1.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-04-19T16:15:13.183",
  "references": [
    {
      "url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0001",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@autodesk.com"
    },
    {
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-1070/",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "psirt@autodesk.com"
    },
    {
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-466/",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "psirt@autodesk.com"
    },
    {
      "url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0001",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-1070/",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-466/",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A user may be tricked into opening a malicious FBX file which may exploit a Directory Traversal Remote Code Execution vulnerability in FBX’s Review causing it to run arbitrary code on the system."
    },
    {
      "lang": "es",
      "value": "Un usuario puede ser engañado para abrir un archivo FBX malicioso que puede explotar una vulnerabilidad de Ejecución de Código Remota Salto de Directorio en Review de FBX, causando que se ejecute un código arbitrario en el sistema"
    }
  ],
  "lastModified": "2026-06-17T03:44:09.487",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:autodesk:fbx_review:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F59286B6-7D60-4BDC-8528-5D9446997E6C",
              "versionEndIncluding": "1.5.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@autodesk.com"
}