Security Advisory

CVE-2025-35053

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2025-10-09 20:20:18

Last updated 2025-10-10 19:36:34

Assigner cisa-cg

State PUBLISHED

Description

Newforma Info Exchange (NIX) accepts requests to /UserWeb/Common/MarkupServices.ashx specifying the DownloadExportedPDF command that allow an authenticated user to read and delete arbitrary files with NT AUTHORITYNetworkService privileges. In Newforma before 2023.1, anonymous access is enabled by default (CVE-2025-35062), allowing an otherwise unauthenticated attacker to effectively authenticate as anonymous and exploit this file upload vulnerability.

← Browse all CVEs View on cve.org ↗