CVE-2008-4471

Autodesk Design Review - Path Traversal

Title source: rule

Description

Directory traversal vulnerability in the CExpressViewerControl class in the DWF Viewer ActiveX control (AdView.dll 9.0.0.96), as used in Revit Architecture 2009 SP2 and Autodesk Design Review 2009, allows remote attackers to overwrite arbitrary files via "..\" sequences in the argument to the SaveAS method.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Nine:Situations:Group · htmlremotewindows

https://www.exploit-db.com/exploits/6630

View Code ZIP pw:eip

References (8)

[Exploit] http://retrogod.altervista.org/9sg_autodesk_revit_arch_2009_exploit.html

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/45519

[Vendor Advisory] http://secunia.com/advisories/31989

[Exploit, Third Party Advisory] https://www.exploit-db.com/exploits/6630

[Third Party Advisory] http://securityreason.com/securityalert/4361

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/31487

[Third Party Advisory] http://www.vupen.com/english/advisories/2008/2704

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/496847/100/0/threaded

Scores

EPSS 0.0625

EPSS Percentile 90.9%

Details

CWE

CWE-22

Status published

Products (3)

autodesk/design_review 2009

autodesk/dwf_viewer

autodesk/revit_architecture 2009 sp2

Published Oct 07, 2008

Tracked Since Feb 18, 2026