CVE-2023-29056

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

A valid LDAP user, under specific conditions, will default to read-only permissions when authenticating into XCC. To be vulnerable, XCC must be configured to use an LDAP server for Authentication/Authorization and have the login permission attribute not defined.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published: Apr 28, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-290578.8A valid XCC user's local account permissions overrides their active directory permissions under specific configurations. This could lead to CVE-2023-290586.5A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts and the user trespass message CVE-2023-290597.83CX DesktopApp through 18.12.416 has embedded malicious code, as exploited in the wild in March 2023. This affects versions 18.12.407 and 18 CVE-2023-29066.5Due to a failure in validating the length provided by an attacker-crafted CP2179 packet, Wireshark versions 2.0.0 through 4.0.7 is susceptib CVE-2023-290605.7The FACSChorus workstation operating system does not restrict what devices can interact with its USB ports. If exploited, a threat actor wit CVE-2023-290615.2There is no BIOS password on the FACSChorus workstation. A threat actor with physical access to the workstation can potentially exploit this CVE-2023-290623.8The Operating System hosting the FACSChorus application is configured to allow transmission of hashed user credentials upon user action with CVE-2023-290632.4The FACSChorus workstation does not prevent physical access to its PCI express (PCIe) slots, which could allow a threat actor to insert a PC CVE-2023-290644.3The FACSChorus software contains sensitive information stored in plaintext. A threat actor could gain hardcoded secrets used by the applicat CVE-2023-290654.3The FACSChorus software database can be accessed directly with the privileges of the currently logged-in user. A threat actor with physical CVE-2023-290663.5The FACSChorus software does not properly assign data access privileges for operating system user accounts. A non-administrative OS account CVE-2023-290677.8A maliciously crafted X_B file when parsed through Autodesk® AutoCAD® 2023 could lead to memory corruption vulnerability by write access vio