Link following in Autodesk Desktop App (ADA) - CVE-2022-33882

Vulnerability identifier: #VU65890

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-33882

CWE-ID: CWE-59

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to insecure link following when deleting files. A local user can delete critical files on the system and execute arbitrary code with escalated privileges.

Autodesk Desktop App (ADA)
Autodesk AutoCAD
AutoCAD Plant 3D
AutoCAD Map 3D
AutoCAD Mechanical
AutoCAD Electrical
AutoCAD Architecture
AutoCAD MEP
AutoCAD Mac LT
Autodesk Civil 3D
AutoCAD Mac
Advance Steel
AutoCAD LT
Alias Concept
Alias AutoStudio
Alias Surface

Install updates from vendor's website.

Autodesk Desktop App (ADA) - update to 8.5.0.17
Autodesk AutoCAD - addressed in versions 2022.1.3, 2023.1.1
AutoCAD Plant 3D - addressed in versions 2022.1.3, 2023.1.1
AutoCAD Map 3D - addressed in versions 2022.1.3, 2023.1.1
AutoCAD Mechanical - addressed in versions 2022.1.3, 2023.1.1
AutoCAD Electrical - addressed in versions 2022.1.3, 2023.1.1
AutoCAD Architecture - addressed in versions 2022.1.3, 2023.1.1
AutoCAD MEP - addressed in versions 2022.1.3, 2023.1.1
AutoCAD Mac LT - addressed in versions 2022.1.3, 2023.1.1
Autodesk Civil 3D - addressed in versions 2022.1.3, 2023.1.1
AutoCAD Mac - addressed in versions 2022.1.3, 2023.1.1
Advance Steel - addressed in versions 2022.1.3, 2023.1.1
AutoCAD LT - addressed in versions 2022.1.3, 2023.1.1
Alias Concept - update to 2023.0.1
Alias AutoStudio - update to 2023.0.1
Alias Surface - update to 2023.0.1

• https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0015
• https://www.zerodayinitiative.com/advisories/ZDI-22-1035/
• https://www.zerodayinitiative.com/advisories/ZDI-22-1034/

• Privilege escalation in Autodesk desktop app (ADA)
• Multiple Autodesk products update for Zlib