ZDI-CAN-18156: ZDI-23-750: SAP 3D Visual Enterprise Author DST File Parsing Use-After-Free Remote Code Execution Vulnerability

Published May 31, 2023

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of SAP 3D Visual Enterprise Author. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

Affected Software

1 affected component

SAP 3D Visual Enterprise Author

Event History

May 31, 2023

Advisory Published

05:00 AM

Data Sourced

05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-18156?

The severity of ZDI-CAN-18156 is critical due to its ability to allow remote code execution.

How do I fix ZDI-CAN-18156?

To fix ZDI-CAN-18156, apply the latest security patch provided by SAP for the 3D Visual Enterprise Author.

What types of attacks can exploit ZDI-CAN-18156?

ZDI-CAN-18156 can be exploited through a malicious page or file that requires user interaction.

Which versions of SAP 3D Visual Enterprise Author are affected by ZDI-CAN-18156?

All installations of SAP 3D Visual Enterprise Author are potentially affected by ZDI-CAN-18156.

Is user interaction necessary for ZDI-CAN-18156 to be exploited?

Yes, user interaction is required for ZDI-CAN-18156 as the target must visit a malicious page or open a malicious file.