Vulnerability · Published Aug 3, 2023 · Assigned by nvidia

CVE-2023-25524

Medium 4.0

In plain English

A medium-severity security flaw in Omniverse Workstation Launcher from NVIDIA. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 3.1)4.0Medium

Exploit odds (30 days)0.4%top 70.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

NVIDIA Omniverse Workstation Launcher for Windows and Linux contains a vulnerability in the authentication flow, where a user’s access token is displayed in the browser user's address bar. An attacker could use this token to impersonate the user to access launcher resources. A successful exploit of this vulnerability may lead to information disclosure.

Affected products (as reported)

Vendor	Product	Versions
NVIDIA	Omniverse Workstation Launcher	1.8.7 and prior versions

Weakness: CWE-598 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://nvidia.custhelp.com/app/answers/detail/a_id/5472