Lucene search

K
nvidiaNvidiaNVIDIA:5472
HistoryAug 03, 2023 - 12:00 a.m.

Security Bulletin - Omniverse Launcher - August 2023

2023-08-0300:00:00
nvidia.custhelp.com
7
nvidia
omniverse
launcher
security update
information disclosure
vulnerability
authentication
windows
linux
software
update
cve-2023-25524

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

0.0005 Low

EPSS

Percentile

16.7%

NVIDIA has released a software update for the Omniverse Workstation Launcher to address a security issue that may lead to information disclosure.

To protect your system, download and apply the update for the Omniverse platform that you are using.

Go to NVIDIA Product Security.

Details

This section provides a summary of potential vulnerabilities that this security update addresses and their impact. Descriptions use CWEβ„’, and base scores and vectors use CVSS v3.1 standards.

CVE ID Description Base Score Vector
CVE‑2023‑25524 NVIDIA Omniverse Workstation Launcher for Windows and Linux contains a vulnerability in the authentication flow, where a user’s access token is displayed in the browser user’s address bar. An attacker could use this token to impersonate the user to access launcher resources. A successful exploit of this vulnerability may lead to information disclosure. 4.0 CWE-598
AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

The NVIDIA risk assessment is based on an average of risk across a diverse set of installed systems and may not represent the true risk to your local installation. NVIDIA recommends consulting a security or IT professional to evaluate the risk to your specific configuration.

Security Updates

The following table lists the NVIDIA software products affected, software versions affected, and the updated version that includes this security update.

CVE IDs Addressed Software Product Affected Versions Updated Version
CVE-2023-25524 Omniverse Workstation Launcher 1.8.7 and prior versions 1.8.11

Notes

  • Earlier software releases of this product might also be affected. If you are using an earlier release, upgrade to the latest release.
CPENameOperatorVersion
omniverse workstation launcherlt1.8.11

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

0.0005 Low

EPSS

Percentile

16.7%

Related for NVIDIA:5472