CVE-2023-3588 (GCVE-0-2023-3588)
Vulnerability from cvelistv5
Published
2023-09-13 18:22
Modified
2024-08-02 07:01
Severity ?
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary
A stored Cross-site Scripting (XSS) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x allows an attacker to execute arbitrary script code.
References
Impacted products
Vendor Product Version
Dassault Systèmes Teamwork Cloud - Business Edition Version: No Magic Release 2021x Golden   <
Version: No Magic Release 2022x Golden   <
Create a notification for this product.
   Dassault Systèmes Teamwork Cloud - Enterprise Edition Version: No Magic Release 2021x Golden   <
Version: No Magic Release 2022x Golden   <
Create a notification for this product.
   Dassault Systèmes Teamwork Cloud - Business Pro Edition Version: No Magic Release 2021x Golden   <
Version: No Magic Release 2022x Golden   <
Create a notification for this product.
   Dassault Systèmes Teamwork Cloud - Standard Edition Version: No Magic Release 2021x Golden   <
Version: No Magic Release 2022x Golden   <
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-3588",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-16T18:38:50.525810Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-16T18:39:04.541Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T07:01:57.318Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.3ds.com/vulnerability/advisories"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Teamwork Cloud - Business Edition",
          "vendor": "Dassault Syst\u00e8mes",
          "versions": [
            {
              "lessThanOrEqual": "No Magic Release 2021x Refresh2",
              "status": "affected",
              "version": "No Magic Release 2021x Golden",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "No Magic Release 2022x Refresh2",
              "status": "affected",
              "version": "No Magic Release 2022x Golden",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Teamwork Cloud - Enterprise Edition",
          "vendor": "Dassault Syst\u00e8mes",
          "versions": [
            {
              "lessThanOrEqual": "No Magic Release 2021x Refresh2",
              "status": "affected",
              "version": "No Magic Release 2021x Golden",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "No Magic Release 2022x Refresh2",
              "status": "affected",
              "version": "No Magic Release 2022x Golden",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Teamwork Cloud - Business Pro Edition",
          "vendor": "Dassault Syst\u00e8mes",
          "versions": [
            {
              "lessThanOrEqual": "No Magic Release 2021x Refresh2",
              "status": "affected",
              "version": "No Magic Release 2021x Golden",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "No Magic Release 2022x Refresh2",
              "status": "affected",
              "version": "No Magic Release 2022x Golden",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Teamwork Cloud - Standard Edition",
          "vendor": "Dassault Syst\u00e8mes",
          "versions": [
            {
              "lessThanOrEqual": "No Magic Release 2021x Refresh2",
              "status": "affected",
              "version": "No Magic Release 2021x Golden",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "No Magic Release 2022x Refresh2",
              "status": "affected",
              "version": "No Magic Release 2022x Golden",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Johannes R\u00fcckert from mgm security partners GmbH"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A stored Cross-site Scripting (XSS) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x allows an attacker to execute arbitrary script code."
            }
          ],
          "value": "A stored Cross-site Scripting (XSS) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x allows an attacker to execute arbitrary script code."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-592",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-592 Stored XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-15T00:27:54.327174Z",
        "orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
        "shortName": "3DS"
      },
      "references": [
        {
          "url": "https://www.3ds.com/vulnerability/advisories"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Stored Cross-site Scripting (XSS) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
    "assignerShortName": "3DS",
    "cveId": "CVE-2023-3588",
    "datePublished": "2023-09-13T18:22:11.313Z",
    "dateReserved": "2023-07-10T14:22:49.873Z",
    "dateUpdated": "2024-08-02T07:01:57.318Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-3588\",\"sourceIdentifier\":\"3DS.Information-Security@3ds.com\",\"published\":\"2023-09-13T19:15:07.787\",\"lastModified\":\"2024-11-21T08:17:36.790\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A stored Cross-site Scripting (XSS) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x allows an attacker to execute arbitrary script code.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad de Cross-Site Scripting (XSS) almacenado que afecta a Teamwork Cloud desde No Magic Release 2021x hasta No Magic Release 2022x permite a un atacante ejecutar scripts de comandos arbitrarios.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"3DS.Information-Security@3ds.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.3,\"impactScore\":2.7},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.3,\"impactScore\":2.7}]},\"weaknesses\":[{\"source\":\"3DS.Information-Security@3ds.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:3ds:teamwork_cloud_no_magic_release:2021x:*:*:*:business:*:*:*\",\"matchCriteriaId\":\"E3465527-6062-4671-932F-5AC8CB6CAE76\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:3ds:teamwork_cloud_no_magic_release:2021x:*:*:*:business_pro:*:*:*\",\"matchCriteriaId\":\"2E7ADE53-CDAC-4135-A452-C81289828F47\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:3ds:teamwork_cloud_no_magic_release:2021x:*:*:*:enterprise:*:*:*\",\"matchCriteriaId\":\"CC55035D-9D34-4B26-9B89-BEF735AF0465\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:3ds:teamwork_cloud_no_magic_release:2021x:*:*:*:standard:*:*:*\",\"matchCriteriaId\":\"D1BBE2EE-6042-4F9C-A423-5BF8C58757F0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:3ds:teamwork_cloud_no_magic_release:2022x:*:*:*:business:*:*:*\",\"matchCriteriaId\":\"CBED6A07-495A-45E2-8670-6D0093E4E332\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:3ds:teamwork_cloud_no_magic_release:2022x:*:*:*:business_pro:*:*:*\",\"matchCriteriaId\":\"5F10E179-1EAA-4C34-96DE-197F82EE2CA1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:3ds:teamwork_cloud_no_magic_release:2022x:*:*:*:enterprise:*:*:*\",\"matchCriteriaId\":\"BFEB98EE-3955-4A58-ACEE-59DDE97AFA34\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:3ds:teamwork_cloud_no_magic_release:2022x:*:*:*:standard:*:*:*\",\"matchCriteriaId\":\"18C200BF-E20D-4FB7-83EA-24DBFA01D0BB\"}]}]}],\"references\":[{\"url\":\"https://www.3ds.com/vulnerability/advisories\",\"source\":\"3DS.Information-Security@3ds.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.3ds.com/vulnerability/advisories\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://www.3ds.com/vulnerability/advisories\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T07:01:57.318Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-3588\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-07-16T18:38:50.525810Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-16T18:39:00.761Z\"}}], \"cna\": {\"title\": \"Stored Cross-site Scripting (XSS) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"user\": \"00000000-0000-4000-9000-000000000000\", \"value\": \"Johannes R\\u00fcckert from mgm security partners GmbH\"}], \"impacts\": [{\"capecId\": \"CAPEC-592\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-592 Stored XSS\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 5.4, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"LOW\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Dassault Syst\\u00e8mes\", \"product\": \"Teamwork Cloud - Business Edition\", \"versions\": [{\"status\": \"affected\", \"version\": \"No Magic Release 2021x Golden\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"No Magic Release 2021x Refresh2\"}, {\"status\": \"affected\", \"version\": \"No Magic Release 2022x Golden\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"No Magic Release 2022x Refresh2\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Dassault Syst\\u00e8mes\", \"product\": \"Teamwork Cloud - Enterprise Edition\", \"versions\": [{\"status\": \"affected\", \"version\": \"No Magic Release 2021x Golden\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"No Magic Release 2021x Refresh2\"}, {\"status\": \"affected\", \"version\": \"No Magic Release 2022x Golden\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"No Magic Release 2022x Refresh2\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Dassault Syst\\u00e8mes\", \"product\": \"Teamwork Cloud - Business Pro Edition\", \"versions\": [{\"status\": \"affected\", \"version\": \"No Magic Release 2021x Golden\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"No Magic Release 2021x Refresh2\"}, {\"status\": \"affected\", \"version\": \"No Magic Release 2022x Golden\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"No Magic Release 2022x Refresh2\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Dassault Syst\\u00e8mes\", \"product\": \"Teamwork Cloud - Standard Edition\", \"versions\": [{\"status\": \"affected\", \"version\": \"No Magic Release 2021x Golden\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"No Magic Release 2021x Refresh2\"}, {\"status\": \"affected\", \"version\": \"No Magic Release 2022x Golden\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"No Magic Release 2022x Refresh2\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://www.3ds.com/vulnerability/advisories\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A stored Cross-site Scripting (XSS) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x allows an attacker to execute arbitrary script code.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"A stored Cross-site Scripting (XSS) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x allows an attacker to execute arbitrary script code.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"f5a594e6-46a7-4e60-8a08-0a786e70e433\", \"shortName\": \"3DS\", \"dateUpdated\": \"2024-07-15T00:27:54.327174Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-3588\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-02T07:01:57.318Z\", \"dateReserved\": \"2023-07-10T14:22:49.873Z\", \"assignerOrgId\": \"f5a594e6-46a7-4e60-8a08-0a786e70e433\", \"datePublished\": \"2023-09-13T18:22:11.313Z\", \"assignerShortName\": \"3DS\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.