CVE-2026-35383 in iTwin Platform
要約 (英語)
Bentley Systems iTwin Platform exposed a Cesium ion access token in the source of some web pages. An unauthenticated attacker could use this token to enumerate or delete certain assets. As of 2026-03-27, the token is no longer present in the web pages and cannot be used to enumerate or delete assets.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
責任者
cisa-cg
予約する
2026年04月02日
公開
2026年04月02日
ステータス
確認済み
エントリ
VulDB provides additional information and datapoints for this CVE:
| 識別子 | 脆弱性 | CWE | 悪用可 | 対策 | CVE |
|---|---|---|---|---|---|
| 355015 | Bentley iTwin Platform Access Token 情報漏えい | 540 | 未定義 | 公式な修正 | CVE-2026-35383 |