IDOR Vulnerability Allowing Unauthorized Profile Picture Change

Summary

An IDOR (Insecure Direct Object Reference) vulnerability was found on Autodesk User Profile, through the "id" parameter which could have allowed an attacker to edit another user's photo. Autodesk has fixed the vulnerability and we thank @tasin_zucced___ for reporting this issue.

An Insecure Direct Object Reference vulnerability was discovered in the Edit Photo functionality of profile.autodesk.com. This flaw allows an attacker to change the profile picture of any user without authorization.