Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
22 vulnerabilities by dassault
CVE-2024-10204 (GCVE-0-2024-10204)
Vulnerability from nvd – Published: 2024-11-19 13:15 – Updated: 2024-11-19 14:09
VLAI
EPSS
VEX
Title
Heap-based Buffer Overflow and Uninitialized Variable vulnerabilities exist in eDrawings from Release SOLIDWORKS 2024 through Release SOLIDWORKS 2025
Summary
Heap-based Buffer Overflow and Uninitialized Variable vulnerabilities exist in the X_B and SAT file reading procedure in eDrawings from Release SOLIDWORKS 2024 through Release SOLIDWORKS 2025. These vulnerabilities could allow an attacker to execute arbitrary code while opening a specially crafted X_B or SAT file.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-11-19 14:04 UTC
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Dassault Systèmes | eDrawings |
Affected:
Release SOLIDWORKS 2024 SP0 , ≤ Release SOLIDWORKS 2024 SP5
(custom)
Affected: Release SOLIDWORKS 2025 SP0 |
|
| dassault | edrawings |
Affected:
solidworks_2024_sp0 , ≤ solidworks_2024_sp5
(custom)
Affected: solidworks_2025_sp0 cpe:2.3:a:dassault:edrawings:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:dassault:edrawings:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "edrawings",
"vendor": "dassault",
"versions": [
{
"lessThanOrEqual": "solidworks_2024_sp5",
"status": "affected",
"version": "solidworks_2024_sp0",
"versionType": "custom"
},
{
"status": "affected",
"version": "solidworks_2025_sp0"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-10204",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-19T14:04:48.309764Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-19T14:09:14.475Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "eDrawings",
"vendor": "Dassault Syst\u00e8mes",
"versions": [
{
"lessThanOrEqual": "Release SOLIDWORKS 2024 SP5",
"status": "affected",
"version": "Release SOLIDWORKS 2024 SP0",
"versionType": "custom"
},
{
"status": "affected",
"version": "Release SOLIDWORKS 2025 SP0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Mat Powell of Trend Micro Zero Day Initiative"
},
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Andrea Micalizzi aka rgod (@rgod777) working with Trend Micro Zero Day Initiative"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Heap-based Buffer Overflow and Uninitialized Variable vulnerabilities exist in the X_B and SAT file reading procedure in eDrawings from Release SOLIDWORKS 2024 through Release SOLIDWORKS 2025. These vulnerabilities could allow an attacker to execute arbitrary code while opening a specially crafted X_B or SAT file."
}
],
"value": "Heap-based Buffer Overflow and Uninitialized Variable vulnerabilities exist in the X_B and SAT file reading procedure in eDrawings from Release SOLIDWORKS 2024 through Release SOLIDWORKS 2025. These vulnerabilities could allow an attacker to execute arbitrary code while opening a specially crafted X_B or SAT file."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-457",
"description": "CWE-457: Use of Uninitialized Variable",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-19T13:15:41.223Z",
"orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
"shortName": "3DS"
},
"references": [
{
"url": "https://www.3ds.com/vulnerability/advisories"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Heap-based Buffer Overflow and Uninitialized Variable vulnerabilities exist in eDrawings from Release SOLIDWORKS 2024 through Release SOLIDWORKS 2025",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
"assignerShortName": "3DS",
"cveId": "CVE-2024-10204",
"datePublished": "2024-11-19T13:15:41.223Z",
"dateReserved": "2024-10-21T07:28:40.214Z",
"dateUpdated": "2024-11-19T14:09:14.475Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-7737 (GCVE-0-2024-7737)
Vulnerability from nvd – Published: 2024-09-19 15:19 – Updated: 2024-09-19 17:11
VLAI
EPSS
VEX
Title
Stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x
Summary
A stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
Severity
8.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-19 17:05 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
References
1 reference
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Dassault Systèmes | 3DSwymer |
Affected:
Release 3DEXPERIENCE R2022x Golden , ≤ Release 3DEXPERIENCE R2022x.FP.CFA.2424
(custom)
Affected: Release 3DEXPERIENCE R2023x Golden , ≤ Release 3DEXPERIENCE R2023x.FP.CFA.2428 (custom) Affected: Release 3DEXPERIENCE R2024x Golden , ≤ Release 3DEXPERIENCE R2024x.FP.CFA.2424 (custom) |
|
| dassault | 3dswymer_3dexperience_2022 |
Affected:
0 , ≤ fp.cfa.2424
(custom)
cpe:2.3:a:dassault:3dswymer_3dexperience_2022:*:*:*:*:*:*:*:* |
|
| dassault | 3dswymer_3dexperience_2023 |
Affected:
0 , ≤ fp.cfa.2428
(custom)
cpe:2.3:a:dassault:3dswymer_3dexperience_2023:*:*:*:*:*:*:*:* |
|
| dassault | 3dswymer_3dexperience_2024 |
Affected:
0 , ≤ fp.cfa.2424
(custom)
cpe:2.3:a:dassault:3dswymer_3dexperience_2024:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:dassault:3dswymer_3dexperience_2022:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "3dswymer_3dexperience_2022",
"vendor": "dassault",
"versions": [
{
"lessThanOrEqual": "fp.cfa.2424",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:dassault:3dswymer_3dexperience_2023:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "3dswymer_3dexperience_2023",
"vendor": "dassault",
"versions": [
{
"lessThanOrEqual": "fp.cfa.2428",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:dassault:3dswymer_3dexperience_2024:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "3dswymer_3dexperience_2024",
"vendor": "dassault",
"versions": [
{
"lessThanOrEqual": "fp.cfa.2424",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-7737",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-19T17:05:22.886382Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-19T17:11:41.088Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "3DSwymer",
"vendor": "Dassault Syst\u00e8mes",
"versions": [
{
"lessThanOrEqual": "Release 3DEXPERIENCE R2022x.FP.CFA.2424",
"status": "affected",
"version": "Release 3DEXPERIENCE R2022x Golden",
"versionType": "custom"
},
{
"lessThanOrEqual": "Release 3DEXPERIENCE R2023x.FP.CFA.2428",
"status": "affected",
"version": "Release 3DEXPERIENCE R2023x Golden",
"versionType": "custom"
},
{
"lessThanOrEqual": "Release 3DEXPERIENCE R2024x.FP.CFA.2424",
"status": "affected",
"version": "Release 3DEXPERIENCE R2024x Golden",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user\u0027s browser session."
}
],
"value": "A stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user\u0027s browser session."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-19T15:19:58.861Z",
"orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
"shortName": "3DS"
},
"references": [
{
"url": "https://www.3ds.com/vulnerability/advisories"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
"assignerShortName": "3DS",
"cveId": "CVE-2024-7737",
"datePublished": "2024-09-19T15:19:58.861Z",
"dateReserved": "2024-08-13T13:57:43.381Z",
"dateUpdated": "2024-09-19T17:11:41.088Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-8004 (GCVE-0-2024-8004)
Vulnerability from nvd – Published: 2024-09-02 11:49 – Updated: 2024-09-03 14:47
VLAI
EPSS
VEX
Title
Stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x
Summary
A stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
Severity
8.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-03 14:45 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
References
1 reference
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Dassault Systèmes | ENOVIA Collaborative Industry Innovator |
Affected:
Release 3DEXPERIENCE R2022x Golden , ≤ Release 3DEXPERIENCE R2022x.FP.CFA.2406
(custom)
Affected: Release 3DEXPERIENCE R2023x Golden , ≤ Release 3DEXPERIENCE R2023x.FP.CFA.2410 (custom) Affected: Release 3DEXPERIENCE R2024x Golden , ≤ Release 3DEXPERIENCE R2024x.FP.CFA.2405 (custom) |
|
| dassault | 3dswymer_3dexperience_2022 |
Affected:
R2022x Golden , ≤ R2022x.FP.CFA.2406
(custom)
cpe:2.3:a:dassault:3dswymer_3dexperience_2022:*:*:*:*:*:*:*:* |
|
| dassault | 3dswymer_3dexperience_2023 |
Affected:
R2023x Golden , ≤ R2023x.FP.CFA.2410
(custom)
cpe:2.3:a:dassault:3dswymer_3dexperience_2023:*:*:*:*:*:*:*:* |
|
| dassault | 3dswymer_3dexperience_2024 |
Affected:
R2024x Golden , ≤ R2024x.FP.CFA.2405
(custom)
cpe:2.3:a:dassault:3dswymer_3dexperience_2024:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:dassault:3dswymer_3dexperience_2022:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "3dswymer_3dexperience_2022",
"vendor": "dassault",
"versions": [
{
"lessThanOrEqual": "R2022x.FP.CFA.2406",
"status": "affected",
"version": "R2022x Golden",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:dassault:3dswymer_3dexperience_2023:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "3dswymer_3dexperience_2023",
"vendor": "dassault",
"versions": [
{
"lessThanOrEqual": "R2023x.FP.CFA.2410",
"status": "affected",
"version": "R2023x Golden",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:dassault:3dswymer_3dexperience_2024:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "3dswymer_3dexperience_2024",
"vendor": "dassault",
"versions": [
{
"lessThanOrEqual": "R2024x.FP.CFA.2405",
"status": "affected",
"version": "R2024x Golden",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-8004",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-03T14:45:22.176417Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-03T14:47:00.811Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ENOVIA Collaborative Industry Innovator",
"vendor": "Dassault Syst\u00e8mes",
"versions": [
{
"lessThanOrEqual": "Release 3DEXPERIENCE R2022x.FP.CFA.2406",
"status": "affected",
"version": "Release 3DEXPERIENCE R2022x Golden",
"versionType": "custom"
},
{
"lessThanOrEqual": "Release 3DEXPERIENCE R2023x.FP.CFA.2410",
"status": "affected",
"version": "Release 3DEXPERIENCE R2023x Golden",
"versionType": "custom"
},
{
"lessThanOrEqual": "Release 3DEXPERIENCE R2024x.FP.CFA.2405",
"status": "affected",
"version": "Release 3DEXPERIENCE R2024x Golden",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user\u0027s browser session."
}
],
"value": "A stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user\u0027s browser session."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-02T11:49:05.542Z",
"orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
"shortName": "3DS"
},
"references": [
{
"url": "https://www.3ds.com/vulnerability/advisories"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
"assignerShortName": "3DS",
"cveId": "CVE-2024-8004",
"datePublished": "2024-09-02T11:49:05.542Z",
"dateReserved": "2024-08-20T08:11:11.055Z",
"dateUpdated": "2024-09-03T14:47:00.811Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-7939 (GCVE-0-2024-7939)
Vulnerability from nvd – Published: 2024-09-02 11:49 – Updated: 2024-09-13 07:02
VLAI
EPSS
VEX
Title
Stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2024x
Summary
A stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
Severity
8.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-03 14:13 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Dassault Systèmes | 3DSwymer |
Affected:
Release 3DEXPERIENCE R2024x Golden , ≤ Release 3DEXPERIENCE R2024x.FP.CFA.2405
(custom)
|
|
| dassault | 3dswymer_3dexperience_2024 |
Affected:
R2024x Golden , ≤ R2024x.FP.CFA.2405
(custom)
cpe:2.3:a:dassault:3dswymer_3dexperience_2024:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:dassault:3dswymer_3dexperience_2024:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "3dswymer_3dexperience_2024",
"vendor": "dassault",
"versions": [
{
"lessThanOrEqual": "R2024x.FP.CFA.2405",
"status": "affected",
"version": "R2024x Golden",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-7939",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-03T14:13:43.157826Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-03T14:14:35.671Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "3DSwymer",
"vendor": "Dassault Syst\u00e8mes",
"versions": [
{
"lessThanOrEqual": "Release 3DEXPERIENCE R2024x.FP.CFA.2405",
"status": "affected",
"version": "Release 3DEXPERIENCE R2024x Golden",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user\u0027s browser session."
}
],
"value": "A stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user\u0027s browser session."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-13T07:02:19.477Z",
"orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
"shortName": "3DS"
},
"references": [
{
"url": "https://www.3ds.com/vulnerability/advisories"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2024x",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
"assignerShortName": "3DS",
"cveId": "CVE-2024-7939",
"datePublished": "2024-09-02T11:49:00.762Z",
"dateReserved": "2024-08-19T14:40:11.462Z",
"dateUpdated": "2024-09-13T07:02:19.477Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-7938 (GCVE-0-2024-7938)
Vulnerability from nvd – Published: 2024-09-02 11:48 – Updated: 2024-09-03 14:13
VLAI
EPSS
VEX
Title
Stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024x
Summary
A stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
Severity
8.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-03 14:11 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Dassault Systèmes | 3DSwymer |
Affected:
Release 3DEXPERIENCE R2023x Golden , ≤ Release 3DEXPERIENCE R2023x.FP.CFA.2410
(custom)
Affected: Release 3DEXPERIENCE R2024x Golden , ≤ Release 3DEXPERIENCE R2024x.FP.CFA.2405 (custom) |
|
| dassault | 3dswymer_3dexperience_2023 |
Affected:
R2023x Golden , ≤ R2023x.FP.CFA.2410
(custom)
cpe:2.3:a:dassault:3dswymer_3dexperience_2023:*:*:*:*:*:*:*:* |
|
| dassault | 3dswymer_3dexperience_2024 |
Affected:
0R2024x Golden , ≤ R2024x.FP.CFA.2405
(custom)
cpe:2.3:a:dassault:3dswymer_3dexperience_2024:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:dassault:3dswymer_3dexperience_2023:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "3dswymer_3dexperience_2023",
"vendor": "dassault",
"versions": [
{
"lessThanOrEqual": "R2023x.FP.CFA.2410",
"status": "affected",
"version": "R2023x Golden",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:dassault:3dswymer_3dexperience_2024:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "3dswymer_3dexperience_2024",
"vendor": "dassault",
"versions": [
{
"lessThanOrEqual": "R2024x.FP.CFA.2405",
"status": "affected",
"version": "0R2024x Golden",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-7938",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-03T14:11:51.430752Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-03T14:13:26.749Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "3DSwymer",
"vendor": "Dassault Syst\u00e8mes",
"versions": [
{
"lessThanOrEqual": "Release 3DEXPERIENCE R2023x.FP.CFA.2410",
"status": "affected",
"version": "Release 3DEXPERIENCE R2023x Golden",
"versionType": "custom"
},
{
"lessThanOrEqual": "Release 3DEXPERIENCE R2024x.FP.CFA.2405",
"status": "affected",
"version": "Release 3DEXPERIENCE R2024x Golden",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user\u0027s browser session."
}
],
"value": "A stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user\u0027s browser session."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-02T11:48:55.282Z",
"orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
"shortName": "3DS"
},
"references": [
{
"url": "https://www.3ds.com/vulnerability/advisories"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024x",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
"assignerShortName": "3DS",
"cveId": "CVE-2024-7938",
"datePublished": "2024-09-02T11:48:55.282Z",
"dateReserved": "2024-08-19T14:34:52.664Z",
"dateUpdated": "2024-09-03T14:13:26.749Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-7932 (GCVE-0-2024-7932)
Vulnerability from nvd – Published: 2024-09-02 11:48 – Updated: 2024-09-13 07:02
VLAI
EPSS
VEX
Title
Stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer on Release 3DEXPERIENCE R2024x
Summary
A stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
Severity
8.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-03 14:08 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Dassault Systèmes | 3DSwymer |
Affected:
Release 3DEXPERIENCE R2024x Golden , ≤ Release 3DEXPERIENCE R2024x.FP.CFA.2405
(custom)
|
|
| dassault | 3dswymer_3dexperience_2024 |
Affected:
R2024x Golden , ≤ R2024x.FP.CFA.240
(custom)
cpe:2.3:a:dassault:3dswymer_3dexperience_2024:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:dassault:3dswymer_3dexperience_2024:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "3dswymer_3dexperience_2024",
"vendor": "dassault",
"versions": [
{
"lessThanOrEqual": "R2024x.FP.CFA.240",
"status": "affected",
"version": "R2024x Golden",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-7932",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-03T14:08:28.681096Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-03T14:11:29.055Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "3DSwymer",
"vendor": "Dassault Syst\u00e8mes",
"versions": [
{
"lessThanOrEqual": "Release 3DEXPERIENCE R2024x.FP.CFA.2405",
"status": "affected",
"version": "Release 3DEXPERIENCE R2024x Golden",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user\u0027s browser session."
}
],
"value": "A stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user\u0027s browser session."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-13T07:02:11.678Z",
"orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
"shortName": "3DS"
},
"references": [
{
"url": "https://www.3ds.com/vulnerability/advisories"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer on Release 3DEXPERIENCE R2024x",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
"assignerShortName": "3DS",
"cveId": "CVE-2024-7932",
"datePublished": "2024-09-02T11:48:47.727Z",
"dateReserved": "2024-08-19T14:08:42.679Z",
"dateUpdated": "2024-09-13T07:02:11.678Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-6379 (GCVE-0-2024-6379)
Vulnerability from nvd – Published: 2024-08-20 13:44 – Updated: 2024-08-27 08:09
VLAI
EPSS
VEX
Title
Reflected Cross-site Scripting (XSS) vulnerability affecting 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x
Summary
A reflected Cross-site Scripting (XSS) vulnerability affecting 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
Severity
7.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-20 17:42 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
References
1 reference
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Dassault Systèmes | 3DSwymer |
Affected:
Release 3DEXPERIENCE R2022x Golden , ≤ Release 3DEXPERIENCE R2022x.FP.CFA.2424
(custom)
Affected: Release 3DEXPERIENCE R2023x Golden , ≤ Release 3DEXPERIENCE R2023x.FP.CFA.2419 (custom) Affected: Release 3DEXPERIENCE R2024x Golden , ≤ Release 3DEXPERIENCE R2024x.FP.CFA.2424 (custom) |
|
| dassault | 3dswymer_3dexperience_2022 |
Affected:
R2022x Golden , ≤ R2022x.FP.CFA.2424
(custom)
cpe:2.3:a:dassault:3dswymer_3dexperience_2022:*:*:*:*:*:*:*:* |
|
| dassault | 3dswymer_3dexperience_2023 |
Affected:
R2023x Golden , ≤ R2023x.FP.CFA.2419
(custom)
cpe:2.3:a:dassault:3dswymer_3dexperience_2023:*:*:*:*:*:*:*:* |
|
| dassault | 3dswymer_3dexperience_2024 |
Affected:
R2024x Golden , ≤ R2024x.FP.CFA.2424
(custom)
cpe:2.3:a:dassault:3dswymer_3dexperience_2024:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:dassault:3dswymer_3dexperience_2022:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "3dswymer_3dexperience_2022",
"vendor": "dassault",
"versions": [
{
"lessThanOrEqual": "R2022x.FP.CFA.2424",
"status": "affected",
"version": "R2022x Golden",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:dassault:3dswymer_3dexperience_2023:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "3dswymer_3dexperience_2023",
"vendor": "dassault",
"versions": [
{
"lessThanOrEqual": "R2023x.FP.CFA.2419",
"status": "affected",
"version": "R2023x Golden",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:dassault:3dswymer_3dexperience_2024:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "3dswymer_3dexperience_2024",
"vendor": "dassault",
"versions": [
{
"lessThanOrEqual": "R2024x.FP.CFA.2424",
"status": "affected",
"version": "R2024x Golden",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-6379",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-20T17:42:55.459459Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-20T17:46:50.298Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "3DSwymer",
"vendor": "Dassault Syst\u00e8mes",
"versions": [
{
"lessThanOrEqual": "Release 3DEXPERIENCE R2022x.FP.CFA.2424",
"status": "affected",
"version": "Release 3DEXPERIENCE R2022x Golden",
"versionType": "custom"
},
{
"lessThanOrEqual": "Release 3DEXPERIENCE R2023x.FP.CFA.2419",
"status": "affected",
"version": "Release 3DEXPERIENCE R2023x Golden",
"versionType": "custom"
},
{
"lessThanOrEqual": "Release 3DEXPERIENCE R2024x.FP.CFA.2424",
"status": "affected",
"version": "Release 3DEXPERIENCE R2024x Golden",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A reflected Cross-site Scripting (XSS) vulnerability affecting 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user\u0027s browser session."
}
],
"value": "A reflected Cross-site Scripting (XSS) vulnerability affecting 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user\u0027s browser session."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-27T08:09:32.404Z",
"orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
"shortName": "3DS"
},
"references": [
{
"url": "https://www.3ds.com/vulnerability/advisories"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Reflected Cross-site Scripting (XSS) vulnerability affecting 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
"assignerShortName": "3DS",
"cveId": "CVE-2024-6379",
"datePublished": "2024-08-20T13:44:53.360Z",
"dateReserved": "2024-06-27T08:00:00.939Z",
"dateUpdated": "2024-08-27T08:09:32.404Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-6377 (GCVE-0-2024-6377)
Vulnerability from nvd – Published: 2024-08-20 13:45 – Updated: 2024-08-27 08:05
VLAI
EPSS
VEX
Title
URL redirection to untrusted site (open redirect) vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x
Summary
An URL redirection to untrusted site (open redirect) vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to redirect users to an arbitrary website via a crafted URL.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-20 14:52 UTC
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
References
1 reference
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Dassault Systèmes | 3DSwymer |
Affected:
Release 3DEXPERIENCE R2022x Golden , ≤ Release 3DEXPERIENCE R2022x.FP.CFA.2424
(custom)
Affected: Release 3DEXPERIENCE R2023x Golden , ≤ Release 3DEXPERIENCE R2023x.FP.CFA.2419 (custom) Affected: Release 3DEXPERIENCE R2024x Golden , ≤ Release 3DEXPERIENCE R2024x.FP.CFA.2424 (custom) |
|
| dassault | 3dswymer_3dexperience_2022 |
Affected:
0 , ≤ fp.cfa.2424
(custom)
cpe:2.3:a:dassault:3dswymer_3dexperience_2022:*:*:*:*:*:*:*:* |
|
| dassault | 3dswymer_3dexperience_2023 |
Affected:
0 , ≤ fp.cfa.2419
(custom)
cpe:2.3:a:dassault:3dswymer_3dexperience_2023:*:*:*:*:*:*:*:* |
|
| dassault | 3dswymer_3dexperience_2024 |
Affected:
0 , ≤ fp.cfa.2424
(custom)
cpe:2.3:a:dassault:3dswymer_3dexperience_2024:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:dassault:3dswymer_3dexperience_2022:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "3dswymer_3dexperience_2022",
"vendor": "dassault",
"versions": [
{
"lessThanOrEqual": "fp.cfa.2424",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:dassault:3dswymer_3dexperience_2023:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "3dswymer_3dexperience_2023",
"vendor": "dassault",
"versions": [
{
"lessThanOrEqual": "fp.cfa.2419",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:dassault:3dswymer_3dexperience_2024:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "3dswymer_3dexperience_2024",
"vendor": "dassault",
"versions": [
{
"lessThanOrEqual": "fp.cfa.2424",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-6377",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-20T14:52:46.499063Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-20T15:07:15.129Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "3DSwymer",
"vendor": "Dassault Syst\u00e8mes",
"versions": [
{
"lessThanOrEqual": "Release 3DEXPERIENCE R2022x.FP.CFA.2424",
"status": "affected",
"version": "Release 3DEXPERIENCE R2022x Golden",
"versionType": "custom"
},
{
"lessThanOrEqual": "Release 3DEXPERIENCE R2023x.FP.CFA.2419",
"status": "affected",
"version": "Release 3DEXPERIENCE R2023x Golden",
"versionType": "custom"
},
{
"lessThanOrEqual": "Release 3DEXPERIENCE R2024x.FP.CFA.2424",
"status": "affected",
"version": "Release 3DEXPERIENCE R2024x Golden",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An URL redirection to untrusted site (open redirect) vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to redirect users to an arbitrary website via a crafted URL."
}
],
"value": "An URL redirection to untrusted site (open redirect) vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to redirect users to an arbitrary website via a crafted URL."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-27T08:05:08.293Z",
"orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
"shortName": "3DS"
},
"references": [
{
"url": "https://www.3ds.com/vulnerability/advisories"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "URL redirection to untrusted site (open redirect) vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
"assignerShortName": "3DS",
"cveId": "CVE-2024-6377",
"datePublished": "2024-08-20T13:45:35.407Z",
"dateReserved": "2024-06-27T07:57:44.783Z",
"dateUpdated": "2024-08-27T08:05:08.293Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-5599 (GCVE-0-2023-5599)
Vulnerability from nvd – Published: 2023-11-21 09:28 – Updated: 2024-08-07 20:12
VLAI
EPSS
VEX
Title
Stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2023x
Summary
A stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2023x allows an attacker to execute arbitrary script code.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-07 20:12 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Dassault Systèmes | 3DSwymer |
Affected:
Release 3DEXPERIENCE R2022x Golden , ≤ Release 3DEXPERIENCE R2022x.FP.CFA.2337
(custom)
Affected: Release 3DEXPERIENCE R2023x Golden , ≤ Release 3DEXPERIENCE R2023x FP.CFA.2333 (custom) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T08:07:32.475Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.3ds.com/vulnerability/advisories"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-5599",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-07T20:12:47.560385Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-07T20:12:59.659Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "3DSwymer",
"vendor": "Dassault Syst\u00e8mes",
"versions": [
{
"lessThanOrEqual": "Release 3DEXPERIENCE R2022x.FP.CFA.2337",
"status": "affected",
"version": "Release 3DEXPERIENCE R2022x Golden",
"versionType": "custom"
},
{
"lessThanOrEqual": "Release 3DEXPERIENCE R2023x FP.CFA.2333",
"status": "affected",
"version": "Release 3DEXPERIENCE R2023x Golden",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2023x allows an attacker to execute arbitrary script code."
}
],
"value": "A stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2023x allows an attacker to execute arbitrary script code."
}
],
"impacts": [
{
"capecId": "CAPEC-592",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-592 Stored XSS"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-11-21T09:34:11.658Z",
"orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
"shortName": "3DS"
},
"references": [
{
"url": "https://www.3ds.com/vulnerability/advisories"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2023x",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
"assignerShortName": "3DS",
"cveId": "CVE-2023-5599",
"datePublished": "2023-11-21T09:28:35.458Z",
"dateReserved": "2023-10-16T08:52:33.048Z",
"dateUpdated": "2024-08-07T20:12:59.659Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-5598 (GCVE-0-2023-5598)
Vulnerability from nvd – Published: 2023-11-21 09:29 – Updated: 2024-08-02 08:07
VLAI
EPSS
VEX
Title
Stored Cross-site Scripting (XSS) vulnerabilities affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2023x
Summary
Stored Cross-site Scripting (XSS) vulnerabilities affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2023x allow an attacker to execute arbitrary script code.
Severity
5.4 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Dassault Systèmes | 3DSwymer |
Affected:
Release 3DEXPERIENCE R2022x Golden , ≤ Release 3DEXPERIENCE R2022x.FP.CFA.2337
(custom)
Affected: Release 3DEXPERIENCE R2023x Golden , ≤ Release 3DEXPERIENCE R2023x FP.CFA.2333 (custom) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T08:07:31.903Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.3ds.com/vulnerability/advisories"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "3DSwymer",
"vendor": "Dassault Syst\u00e8mes",
"versions": [
{
"lessThanOrEqual": "Release 3DEXPERIENCE R2022x.FP.CFA.2337",
"status": "affected",
"version": "Release 3DEXPERIENCE R2022x Golden",
"versionType": "custom"
},
{
"lessThanOrEqual": "Release 3DEXPERIENCE R2023x FP.CFA.2333",
"status": "affected",
"version": "Release 3DEXPERIENCE R2023x Golden",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Stored Cross-site Scripting (XSS) vulnerabilities affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2023x allow an attacker to execute arbitrary script code."
}
],
"value": "Stored Cross-site Scripting (XSS) vulnerabilities affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2023x allow an attacker to execute arbitrary script code."
}
],
"impacts": [
{
"capecId": "CAPEC-592",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-592 Stored XSS"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-11-29T09:25:56.435Z",
"orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
"shortName": "3DS"
},
"references": [
{
"url": "https://www.3ds.com/vulnerability/advisories"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Stored Cross-site Scripting (XSS) vulnerabilities affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2023x",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
"assignerShortName": "3DS",
"cveId": "CVE-2023-5598",
"datePublished": "2023-11-21T09:29:05.310Z",
"dateReserved": "2023-10-16T08:52:28.948Z",
"dateUpdated": "2024-08-02T08:07:31.903Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-3589 (GCVE-0-2023-3589)
Vulnerability from nvd – Published: 2023-10-09 08:54 – Updated: 2024-09-19 14:58
VLAI
EPSS
VEX
Title
Cross-Site Request Forgery (CSRF) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x
Summary
A Cross-Site Request Forgery (CSRF) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x could allow with some very specific conditions an attacker to send a specifically crafted query to the server.
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-19 14:28 UTC
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
References
1 reference
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Dassault Systèmes | Teamwork Cloud - Business Edition |
Affected:
No Magic Release 2021x Golden , ≤ No Magic Release 2021x Refresh2
(custom)
Affected: No Magic Release 2022x Golden , ≤ No Magic Release 2022x Refresh2 (custom) |
|
| Dassault Systèmes | Teamwork Cloud - Enterprise Edition |
Affected:
No Magic Release 2021x Golden , ≤ No Magic Release 2021x Refresh2
(custom)
Affected: No Magic Release 2022x Golden , ≤ No Magic Release 2022x Refresh2 (custom) |
|
| Dassault Systèmes | Teamwork Cloud - Business Pro Edition |
Affected:
No Magic Release 2021x Golden , ≤ No Magic Release 2021x Refresh2
(custom)
Affected: No Magic Release 2022x Golden , ≤ No Magic Release 2022x Refresh2 (custom) |
|
| Dassault Systèmes | Teamwork Cloud - Standard Edition |
Affected:
No Magic Release 2021x Golden , ≤ No Magic Release 2021x Refresh2
(custom)
Affected: No Magic Release 2022x Golden , ≤ No Magic Release 2022x Refresh2 (custom) |
|
| dassult | teamwork_cloud_business_edition |
Affected:
no_magic_release_2021x_golden , ≤ no_magic_release_2021X_refresh2
(custom)
Affected: no_magic_release_2022x_golden , ≤ no_magic_release_2022x_refresh2 (custom) cpe:2.3:a:dassult:teamwork_cloud_business_edition:*:*:*:*:*:*:*:* |
|
| dassult | teamwork_cloud_business_pro_edition |
Affected:
no_magic_release_2021x_golden , ≤ no_magic_release_2021x_refresh2
(custom)
Affected: no_magic_release_2022x_golden , ≤ no_magic_release2022x_refresh2 (custom) cpe:2.3:a:dassult:teamwork_cloud_business_pro_edition:*:*:*:*:*:*:*:* |
|
| dassault | teamwork_cloud_standard_edition |
Affected:
no_magic_release_2021x_golden , ≤ no_magic_release_2021x_refresh2
(custom)
Affected: no_magic_release_2022x_golden , ≤ no_magic_release_2022x_refresh2 (custom) cpe:2.3:a:dassault:teamwork_cloud_standard_edition:*:*:*:*:*:*:*:* |
|
| dassault | teamwork_cloud_enterprise_edition |
Affected:
no_magic_release_2021x_golden , ≤ no_magic_release_2021_refresh2
(custom)
Affected: no_magic_release_2022x_golden , ≤ no_magic_release_2022_refresh2 (custom) cpe:2.3:a:dassault:teamwork_cloud_enterprise_edition:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T07:01:56.455Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.3ds.com/vulnerability/advisories"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:dassult:teamwork_cloud_business_edition:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "teamwork_cloud_business_edition",
"vendor": "dassult",
"versions": [
{
"lessThanOrEqual": "no_magic_release_2021X_refresh2",
"status": "affected",
"version": "no_magic_release_2021x_golden",
"versionType": "custom"
},
{
"lessThanOrEqual": "no_magic_release_2022x_refresh2",
"status": "affected",
"version": "no_magic_release_2022x_golden",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:dassult:teamwork_cloud_business_pro_edition:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "teamwork_cloud_business_pro_edition",
"vendor": "dassult",
"versions": [
{
"lessThanOrEqual": "no_magic_release_2021x_refresh2",
"status": "affected",
"version": "no_magic_release_2021x_golden",
"versionType": "custom"
},
{
"lessThanOrEqual": "no_magic_release2022x_refresh2",
"status": "affected",
"version": "no_magic_release_2022x_golden",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:dassault:teamwork_cloud_standard_edition:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "teamwork_cloud_standard_edition",
"vendor": "dassault",
"versions": [
{
"lessThanOrEqual": "no_magic_release_2021x_refresh2",
"status": "affected",
"version": "no_magic_release_2021x_golden",
"versionType": "custom"
},
{
"lessThanOrEqual": "no_magic_release_2022x_refresh2",
"status": "affected",
"version": "no_magic_release_2022x_golden",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:dassault:teamwork_cloud_enterprise_edition:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "teamwork_cloud_enterprise_edition",
"vendor": "dassault",
"versions": [
{
"lessThanOrEqual": "no_magic_release_2021_refresh2",
"status": "affected",
"version": "no_magic_release_2021x_golden",
"versionType": "custom"
},
{
"lessThanOrEqual": "no_magic_release_2022_refresh2",
"status": "affected",
"version": "no_magic_release_2022x_golden",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-3589",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-19T14:28:44.230042Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-19T14:58:42.152Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Teamwork Cloud - Business Edition",
"vendor": "Dassault Syst\u00e8mes",
"versions": [
{
"lessThanOrEqual": "No Magic Release 2021x Refresh2",
"status": "affected",
"version": "No Magic Release 2021x Golden",
"versionType": "custom"
},
{
"lessThanOrEqual": "No Magic Release 2022x Refresh2",
"status": "affected",
"version": "No Magic Release 2022x Golden",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Teamwork Cloud - Enterprise Edition",
"vendor": "Dassault Syst\u00e8mes",
"versions": [
{
"lessThanOrEqual": "No Magic Release 2021x Refresh2",
"status": "affected",
"version": "No Magic Release 2021x Golden",
"versionType": "custom"
},
{
"lessThanOrEqual": "No Magic Release 2022x Refresh2",
"status": "affected",
"version": "No Magic Release 2022x Golden",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Teamwork Cloud - Business Pro Edition",
"vendor": "Dassault Syst\u00e8mes",
"versions": [
{
"lessThanOrEqual": "No Magic Release 2021x Refresh2",
"status": "affected",
"version": "No Magic Release 2021x Golden",
"versionType": "custom"
},
{
"lessThanOrEqual": "No Magic Release 2022x Refresh2",
"status": "affected",
"version": "No Magic Release 2022x Golden",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Teamwork Cloud - Standard Edition",
"vendor": "Dassault Syst\u00e8mes",
"versions": [
{
"lessThanOrEqual": "No Magic Release 2021x Refresh2",
"status": "affected",
"version": "No Magic Release 2021x Golden",
"versionType": "custom"
},
{
"lessThanOrEqual": "No Magic Release 2022x Refresh2",
"status": "affected",
"version": "No Magic Release 2022x Golden",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Johannes R\u00fcckert from mgm security partners GmbH"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A Cross-Site Request Forgery (CSRF) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x could allow with some very specific conditions an attacker to send a specifically crafted query to the server."
}
],
"value": "A Cross-Site Request Forgery (CSRF) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x could allow with some very specific conditions an attacker to send a specifically crafted query to the server."
}
],
"impacts": [
{
"capecId": "CAPEC-62",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-62 Cross Site Request Forgery"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-13T09:15:26.671Z",
"orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
"shortName": "3DS"
},
"references": [
{
"url": "https://www.3ds.com/vulnerability/advisories"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Cross-Site Request Forgery (CSRF) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
"assignerShortName": "3DS",
"cveId": "CVE-2023-3589",
"datePublished": "2023-10-09T08:54:08.100Z",
"dateReserved": "2023-07-10T14:22:56.221Z",
"dateUpdated": "2024-09-19T14:58:42.152Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-10204 (GCVE-0-2024-10204)
Vulnerability from cvelistv5 – Published: 2024-11-19 13:15 – Updated: 2024-11-19 14:09
VLAI
EPSS
VEX
Title
Heap-based Buffer Overflow and Uninitialized Variable vulnerabilities exist in eDrawings from Release SOLIDWORKS 2024 through Release SOLIDWORKS 2025
Summary
Heap-based Buffer Overflow and Uninitialized Variable vulnerabilities exist in the X_B and SAT file reading procedure in eDrawings from Release SOLIDWORKS 2024 through Release SOLIDWORKS 2025. These vulnerabilities could allow an attacker to execute arbitrary code while opening a specially crafted X_B or SAT file.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-11-19 14:04 UTC
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Dassault Systèmes | eDrawings |
Affected:
Release SOLIDWORKS 2024 SP0 , ≤ Release SOLIDWORKS 2024 SP5
(custom)
Affected: Release SOLIDWORKS 2025 SP0 |
|
| dassault | edrawings |
Affected:
solidworks_2024_sp0 , ≤ solidworks_2024_sp5
(custom)
Affected: solidworks_2025_sp0 cpe:2.3:a:dassault:edrawings:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:dassault:edrawings:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "edrawings",
"vendor": "dassault",
"versions": [
{
"lessThanOrEqual": "solidworks_2024_sp5",
"status": "affected",
"version": "solidworks_2024_sp0",
"versionType": "custom"
},
{
"status": "affected",
"version": "solidworks_2025_sp0"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-10204",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-19T14:04:48.309764Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-19T14:09:14.475Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "eDrawings",
"vendor": "Dassault Syst\u00e8mes",
"versions": [
{
"lessThanOrEqual": "Release SOLIDWORKS 2024 SP5",
"status": "affected",
"version": "Release SOLIDWORKS 2024 SP0",
"versionType": "custom"
},
{
"status": "affected",
"version": "Release SOLIDWORKS 2025 SP0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Mat Powell of Trend Micro Zero Day Initiative"
},
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Andrea Micalizzi aka rgod (@rgod777) working with Trend Micro Zero Day Initiative"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Heap-based Buffer Overflow and Uninitialized Variable vulnerabilities exist in the X_B and SAT file reading procedure in eDrawings from Release SOLIDWORKS 2024 through Release SOLIDWORKS 2025. These vulnerabilities could allow an attacker to execute arbitrary code while opening a specially crafted X_B or SAT file."
}
],
"value": "Heap-based Buffer Overflow and Uninitialized Variable vulnerabilities exist in the X_B and SAT file reading procedure in eDrawings from Release SOLIDWORKS 2024 through Release SOLIDWORKS 2025. These vulnerabilities could allow an attacker to execute arbitrary code while opening a specially crafted X_B or SAT file."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-457",
"description": "CWE-457: Use of Uninitialized Variable",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-19T13:15:41.223Z",
"orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
"shortName": "3DS"
},
"references": [
{
"url": "https://www.3ds.com/vulnerability/advisories"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Heap-based Buffer Overflow and Uninitialized Variable vulnerabilities exist in eDrawings from Release SOLIDWORKS 2024 through Release SOLIDWORKS 2025",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
"assignerShortName": "3DS",
"cveId": "CVE-2024-10204",
"datePublished": "2024-11-19T13:15:41.223Z",
"dateReserved": "2024-10-21T07:28:40.214Z",
"dateUpdated": "2024-11-19T14:09:14.475Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-7737 (GCVE-0-2024-7737)
Vulnerability from cvelistv5 – Published: 2024-09-19 15:19 – Updated: 2024-09-19 17:11
VLAI
EPSS
VEX
Title
Stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x
Summary
A stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
Severity
8.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-19 17:05 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
References
1 reference
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Dassault Systèmes | 3DSwymer |
Affected:
Release 3DEXPERIENCE R2022x Golden , ≤ Release 3DEXPERIENCE R2022x.FP.CFA.2424
(custom)
Affected: Release 3DEXPERIENCE R2023x Golden , ≤ Release 3DEXPERIENCE R2023x.FP.CFA.2428 (custom) Affected: Release 3DEXPERIENCE R2024x Golden , ≤ Release 3DEXPERIENCE R2024x.FP.CFA.2424 (custom) |
|
| dassault | 3dswymer_3dexperience_2022 |
Affected:
0 , ≤ fp.cfa.2424
(custom)
cpe:2.3:a:dassault:3dswymer_3dexperience_2022:*:*:*:*:*:*:*:* |
|
| dassault | 3dswymer_3dexperience_2023 |
Affected:
0 , ≤ fp.cfa.2428
(custom)
cpe:2.3:a:dassault:3dswymer_3dexperience_2023:*:*:*:*:*:*:*:* |
|
| dassault | 3dswymer_3dexperience_2024 |
Affected:
0 , ≤ fp.cfa.2424
(custom)
cpe:2.3:a:dassault:3dswymer_3dexperience_2024:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:dassault:3dswymer_3dexperience_2022:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "3dswymer_3dexperience_2022",
"vendor": "dassault",
"versions": [
{
"lessThanOrEqual": "fp.cfa.2424",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:dassault:3dswymer_3dexperience_2023:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "3dswymer_3dexperience_2023",
"vendor": "dassault",
"versions": [
{
"lessThanOrEqual": "fp.cfa.2428",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:dassault:3dswymer_3dexperience_2024:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "3dswymer_3dexperience_2024",
"vendor": "dassault",
"versions": [
{
"lessThanOrEqual": "fp.cfa.2424",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-7737",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-19T17:05:22.886382Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-19T17:11:41.088Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "3DSwymer",
"vendor": "Dassault Syst\u00e8mes",
"versions": [
{
"lessThanOrEqual": "Release 3DEXPERIENCE R2022x.FP.CFA.2424",
"status": "affected",
"version": "Release 3DEXPERIENCE R2022x Golden",
"versionType": "custom"
},
{
"lessThanOrEqual": "Release 3DEXPERIENCE R2023x.FP.CFA.2428",
"status": "affected",
"version": "Release 3DEXPERIENCE R2023x Golden",
"versionType": "custom"
},
{
"lessThanOrEqual": "Release 3DEXPERIENCE R2024x.FP.CFA.2424",
"status": "affected",
"version": "Release 3DEXPERIENCE R2024x Golden",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user\u0027s browser session."
}
],
"value": "A stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user\u0027s browser session."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-19T15:19:58.861Z",
"orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
"shortName": "3DS"
},
"references": [
{
"url": "https://www.3ds.com/vulnerability/advisories"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
"assignerShortName": "3DS",
"cveId": "CVE-2024-7737",
"datePublished": "2024-09-19T15:19:58.861Z",
"dateReserved": "2024-08-13T13:57:43.381Z",
"dateUpdated": "2024-09-19T17:11:41.088Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-8004 (GCVE-0-2024-8004)
Vulnerability from cvelistv5 – Published: 2024-09-02 11:49 – Updated: 2024-09-03 14:47
VLAI
EPSS
VEX
Title
Stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x
Summary
A stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
Severity
8.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-03 14:45 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
References
1 reference
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Dassault Systèmes | ENOVIA Collaborative Industry Innovator |
Affected:
Release 3DEXPERIENCE R2022x Golden , ≤ Release 3DEXPERIENCE R2022x.FP.CFA.2406
(custom)
Affected: Release 3DEXPERIENCE R2023x Golden , ≤ Release 3DEXPERIENCE R2023x.FP.CFA.2410 (custom) Affected: Release 3DEXPERIENCE R2024x Golden , ≤ Release 3DEXPERIENCE R2024x.FP.CFA.2405 (custom) |
|
| dassault | 3dswymer_3dexperience_2022 |
Affected:
R2022x Golden , ≤ R2022x.FP.CFA.2406
(custom)
cpe:2.3:a:dassault:3dswymer_3dexperience_2022:*:*:*:*:*:*:*:* |
|
| dassault | 3dswymer_3dexperience_2023 |
Affected:
R2023x Golden , ≤ R2023x.FP.CFA.2410
(custom)
cpe:2.3:a:dassault:3dswymer_3dexperience_2023:*:*:*:*:*:*:*:* |
|
| dassault | 3dswymer_3dexperience_2024 |
Affected:
R2024x Golden , ≤ R2024x.FP.CFA.2405
(custom)
cpe:2.3:a:dassault:3dswymer_3dexperience_2024:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:dassault:3dswymer_3dexperience_2022:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "3dswymer_3dexperience_2022",
"vendor": "dassault",
"versions": [
{
"lessThanOrEqual": "R2022x.FP.CFA.2406",
"status": "affected",
"version": "R2022x Golden",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:dassault:3dswymer_3dexperience_2023:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "3dswymer_3dexperience_2023",
"vendor": "dassault",
"versions": [
{
"lessThanOrEqual": "R2023x.FP.CFA.2410",
"status": "affected",
"version": "R2023x Golden",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:dassault:3dswymer_3dexperience_2024:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "3dswymer_3dexperience_2024",
"vendor": "dassault",
"versions": [
{
"lessThanOrEqual": "R2024x.FP.CFA.2405",
"status": "affected",
"version": "R2024x Golden",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-8004",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-03T14:45:22.176417Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-03T14:47:00.811Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ENOVIA Collaborative Industry Innovator",
"vendor": "Dassault Syst\u00e8mes",
"versions": [
{
"lessThanOrEqual": "Release 3DEXPERIENCE R2022x.FP.CFA.2406",
"status": "affected",
"version": "Release 3DEXPERIENCE R2022x Golden",
"versionType": "custom"
},
{
"lessThanOrEqual": "Release 3DEXPERIENCE R2023x.FP.CFA.2410",
"status": "affected",
"version": "Release 3DEXPERIENCE R2023x Golden",
"versionType": "custom"
},
{
"lessThanOrEqual": "Release 3DEXPERIENCE R2024x.FP.CFA.2405",
"status": "affected",
"version": "Release 3DEXPERIENCE R2024x Golden",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user\u0027s browser session."
}
],
"value": "A stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user\u0027s browser session."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-02T11:49:05.542Z",
"orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
"shortName": "3DS"
},
"references": [
{
"url": "https://www.3ds.com/vulnerability/advisories"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
"assignerShortName": "3DS",
"cveId": "CVE-2024-8004",
"datePublished": "2024-09-02T11:49:05.542Z",
"dateReserved": "2024-08-20T08:11:11.055Z",
"dateUpdated": "2024-09-03T14:47:00.811Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-7939 (GCVE-0-2024-7939)
Vulnerability from cvelistv5 – Published: 2024-09-02 11:49 – Updated: 2024-09-13 07:02
VLAI
EPSS
VEX
Title
Stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2024x
Summary
A stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
Severity
8.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-03 14:13 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Dassault Systèmes | 3DSwymer |
Affected:
Release 3DEXPERIENCE R2024x Golden , ≤ Release 3DEXPERIENCE R2024x.FP.CFA.2405
(custom)
|
|
| dassault | 3dswymer_3dexperience_2024 |
Affected:
R2024x Golden , ≤ R2024x.FP.CFA.2405
(custom)
cpe:2.3:a:dassault:3dswymer_3dexperience_2024:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:dassault:3dswymer_3dexperience_2024:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "3dswymer_3dexperience_2024",
"vendor": "dassault",
"versions": [
{
"lessThanOrEqual": "R2024x.FP.CFA.2405",
"status": "affected",
"version": "R2024x Golden",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-7939",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-03T14:13:43.157826Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-03T14:14:35.671Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "3DSwymer",
"vendor": "Dassault Syst\u00e8mes",
"versions": [
{
"lessThanOrEqual": "Release 3DEXPERIENCE R2024x.FP.CFA.2405",
"status": "affected",
"version": "Release 3DEXPERIENCE R2024x Golden",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user\u0027s browser session."
}
],
"value": "A stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user\u0027s browser session."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-13T07:02:19.477Z",
"orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
"shortName": "3DS"
},
"references": [
{
"url": "https://www.3ds.com/vulnerability/advisories"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2024x",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
"assignerShortName": "3DS",
"cveId": "CVE-2024-7939",
"datePublished": "2024-09-02T11:49:00.762Z",
"dateReserved": "2024-08-19T14:40:11.462Z",
"dateUpdated": "2024-09-13T07:02:19.477Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-7938 (GCVE-0-2024-7938)
Vulnerability from cvelistv5 – Published: 2024-09-02 11:48 – Updated: 2024-09-03 14:13
VLAI
EPSS
VEX
Title
Stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024x
Summary
A stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
Severity
8.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-03 14:11 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Dassault Systèmes | 3DSwymer |
Affected:
Release 3DEXPERIENCE R2023x Golden , ≤ Release 3DEXPERIENCE R2023x.FP.CFA.2410
(custom)
Affected: Release 3DEXPERIENCE R2024x Golden , ≤ Release 3DEXPERIENCE R2024x.FP.CFA.2405 (custom) |
|
| dassault | 3dswymer_3dexperience_2023 |
Affected:
R2023x Golden , ≤ R2023x.FP.CFA.2410
(custom)
cpe:2.3:a:dassault:3dswymer_3dexperience_2023:*:*:*:*:*:*:*:* |
|
| dassault | 3dswymer_3dexperience_2024 |
Affected:
0R2024x Golden , ≤ R2024x.FP.CFA.2405
(custom)
cpe:2.3:a:dassault:3dswymer_3dexperience_2024:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:dassault:3dswymer_3dexperience_2023:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "3dswymer_3dexperience_2023",
"vendor": "dassault",
"versions": [
{
"lessThanOrEqual": "R2023x.FP.CFA.2410",
"status": "affected",
"version": "R2023x Golden",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:dassault:3dswymer_3dexperience_2024:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "3dswymer_3dexperience_2024",
"vendor": "dassault",
"versions": [
{
"lessThanOrEqual": "R2024x.FP.CFA.2405",
"status": "affected",
"version": "0R2024x Golden",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-7938",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-03T14:11:51.430752Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-03T14:13:26.749Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "3DSwymer",
"vendor": "Dassault Syst\u00e8mes",
"versions": [
{
"lessThanOrEqual": "Release 3DEXPERIENCE R2023x.FP.CFA.2410",
"status": "affected",
"version": "Release 3DEXPERIENCE R2023x Golden",
"versionType": "custom"
},
{
"lessThanOrEqual": "Release 3DEXPERIENCE R2024x.FP.CFA.2405",
"status": "affected",
"version": "Release 3DEXPERIENCE R2024x Golden",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user\u0027s browser session."
}
],
"value": "A stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user\u0027s browser session."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-02T11:48:55.282Z",
"orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
"shortName": "3DS"
},
"references": [
{
"url": "https://www.3ds.com/vulnerability/advisories"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024x",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
"assignerShortName": "3DS",
"cveId": "CVE-2024-7938",
"datePublished": "2024-09-02T11:48:55.282Z",
"dateReserved": "2024-08-19T14:34:52.664Z",
"dateUpdated": "2024-09-03T14:13:26.749Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-7932 (GCVE-0-2024-7932)
Vulnerability from cvelistv5 – Published: 2024-09-02 11:48 – Updated: 2024-09-13 07:02
VLAI
EPSS
VEX
Title
Stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer on Release 3DEXPERIENCE R2024x
Summary
A stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
Severity
8.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-03 14:08 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Dassault Systèmes | 3DSwymer |
Affected:
Release 3DEXPERIENCE R2024x Golden , ≤ Release 3DEXPERIENCE R2024x.FP.CFA.2405
(custom)
|
|
| dassault | 3dswymer_3dexperience_2024 |
Affected:
R2024x Golden , ≤ R2024x.FP.CFA.240
(custom)
cpe:2.3:a:dassault:3dswymer_3dexperience_2024:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:dassault:3dswymer_3dexperience_2024:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "3dswymer_3dexperience_2024",
"vendor": "dassault",
"versions": [
{
"lessThanOrEqual": "R2024x.FP.CFA.240",
"status": "affected",
"version": "R2024x Golden",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-7932",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-03T14:08:28.681096Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-03T14:11:29.055Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "3DSwymer",
"vendor": "Dassault Syst\u00e8mes",
"versions": [
{
"lessThanOrEqual": "Release 3DEXPERIENCE R2024x.FP.CFA.2405",
"status": "affected",
"version": "Release 3DEXPERIENCE R2024x Golden",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user\u0027s browser session."
}
],
"value": "A stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user\u0027s browser session."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-13T07:02:11.678Z",
"orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
"shortName": "3DS"
},
"references": [
{
"url": "https://www.3ds.com/vulnerability/advisories"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer on Release 3DEXPERIENCE R2024x",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
"assignerShortName": "3DS",
"cveId": "CVE-2024-7932",
"datePublished": "2024-09-02T11:48:47.727Z",
"dateReserved": "2024-08-19T14:08:42.679Z",
"dateUpdated": "2024-09-13T07:02:11.678Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-6377 (GCVE-0-2024-6377)
Vulnerability from cvelistv5 – Published: 2024-08-20 13:45 – Updated: 2024-08-27 08:05
VLAI
EPSS
VEX
Title
URL redirection to untrusted site (open redirect) vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x
Summary
An URL redirection to untrusted site (open redirect) vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to redirect users to an arbitrary website via a crafted URL.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-20 14:52 UTC
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
References
1 reference
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Dassault Systèmes | 3DSwymer |
Affected:
Release 3DEXPERIENCE R2022x Golden , ≤ Release 3DEXPERIENCE R2022x.FP.CFA.2424
(custom)
Affected: Release 3DEXPERIENCE R2023x Golden , ≤ Release 3DEXPERIENCE R2023x.FP.CFA.2419 (custom) Affected: Release 3DEXPERIENCE R2024x Golden , ≤ Release 3DEXPERIENCE R2024x.FP.CFA.2424 (custom) |
|
| dassault | 3dswymer_3dexperience_2022 |
Affected:
0 , ≤ fp.cfa.2424
(custom)
cpe:2.3:a:dassault:3dswymer_3dexperience_2022:*:*:*:*:*:*:*:* |
|
| dassault | 3dswymer_3dexperience_2023 |
Affected:
0 , ≤ fp.cfa.2419
(custom)
cpe:2.3:a:dassault:3dswymer_3dexperience_2023:*:*:*:*:*:*:*:* |
|
| dassault | 3dswymer_3dexperience_2024 |
Affected:
0 , ≤ fp.cfa.2424
(custom)
cpe:2.3:a:dassault:3dswymer_3dexperience_2024:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:dassault:3dswymer_3dexperience_2022:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "3dswymer_3dexperience_2022",
"vendor": "dassault",
"versions": [
{
"lessThanOrEqual": "fp.cfa.2424",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:dassault:3dswymer_3dexperience_2023:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "3dswymer_3dexperience_2023",
"vendor": "dassault",
"versions": [
{
"lessThanOrEqual": "fp.cfa.2419",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:dassault:3dswymer_3dexperience_2024:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "3dswymer_3dexperience_2024",
"vendor": "dassault",
"versions": [
{
"lessThanOrEqual": "fp.cfa.2424",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-6377",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-20T14:52:46.499063Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-20T15:07:15.129Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "3DSwymer",
"vendor": "Dassault Syst\u00e8mes",
"versions": [
{
"lessThanOrEqual": "Release 3DEXPERIENCE R2022x.FP.CFA.2424",
"status": "affected",
"version": "Release 3DEXPERIENCE R2022x Golden",
"versionType": "custom"
},
{
"lessThanOrEqual": "Release 3DEXPERIENCE R2023x.FP.CFA.2419",
"status": "affected",
"version": "Release 3DEXPERIENCE R2023x Golden",
"versionType": "custom"
},
{
"lessThanOrEqual": "Release 3DEXPERIENCE R2024x.FP.CFA.2424",
"status": "affected",
"version": "Release 3DEXPERIENCE R2024x Golden",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An URL redirection to untrusted site (open redirect) vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to redirect users to an arbitrary website via a crafted URL."
}
],
"value": "An URL redirection to untrusted site (open redirect) vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to redirect users to an arbitrary website via a crafted URL."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-27T08:05:08.293Z",
"orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
"shortName": "3DS"
},
"references": [
{
"url": "https://www.3ds.com/vulnerability/advisories"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "URL redirection to untrusted site (open redirect) vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
"assignerShortName": "3DS",
"cveId": "CVE-2024-6377",
"datePublished": "2024-08-20T13:45:35.407Z",
"dateReserved": "2024-06-27T07:57:44.783Z",
"dateUpdated": "2024-08-27T08:05:08.293Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-6379 (GCVE-0-2024-6379)
Vulnerability from cvelistv5 – Published: 2024-08-20 13:44 – Updated: 2024-08-27 08:09
VLAI
EPSS
VEX
Title
Reflected Cross-site Scripting (XSS) vulnerability affecting 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x
Summary
A reflected Cross-site Scripting (XSS) vulnerability affecting 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
Severity
7.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-20 17:42 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
References
1 reference
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Dassault Systèmes | 3DSwymer |
Affected:
Release 3DEXPERIENCE R2022x Golden , ≤ Release 3DEXPERIENCE R2022x.FP.CFA.2424
(custom)
Affected: Release 3DEXPERIENCE R2023x Golden , ≤ Release 3DEXPERIENCE R2023x.FP.CFA.2419 (custom) Affected: Release 3DEXPERIENCE R2024x Golden , ≤ Release 3DEXPERIENCE R2024x.FP.CFA.2424 (custom) |
|
| dassault | 3dswymer_3dexperience_2022 |
Affected:
R2022x Golden , ≤ R2022x.FP.CFA.2424
(custom)
cpe:2.3:a:dassault:3dswymer_3dexperience_2022:*:*:*:*:*:*:*:* |
|
| dassault | 3dswymer_3dexperience_2023 |
Affected:
R2023x Golden , ≤ R2023x.FP.CFA.2419
(custom)
cpe:2.3:a:dassault:3dswymer_3dexperience_2023:*:*:*:*:*:*:*:* |
|
| dassault | 3dswymer_3dexperience_2024 |
Affected:
R2024x Golden , ≤ R2024x.FP.CFA.2424
(custom)
cpe:2.3:a:dassault:3dswymer_3dexperience_2024:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:dassault:3dswymer_3dexperience_2022:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "3dswymer_3dexperience_2022",
"vendor": "dassault",
"versions": [
{
"lessThanOrEqual": "R2022x.FP.CFA.2424",
"status": "affected",
"version": "R2022x Golden",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:dassault:3dswymer_3dexperience_2023:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "3dswymer_3dexperience_2023",
"vendor": "dassault",
"versions": [
{
"lessThanOrEqual": "R2023x.FP.CFA.2419",
"status": "affected",
"version": "R2023x Golden",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:dassault:3dswymer_3dexperience_2024:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "3dswymer_3dexperience_2024",
"vendor": "dassault",
"versions": [
{
"lessThanOrEqual": "R2024x.FP.CFA.2424",
"status": "affected",
"version": "R2024x Golden",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-6379",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-20T17:42:55.459459Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-20T17:46:50.298Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "3DSwymer",
"vendor": "Dassault Syst\u00e8mes",
"versions": [
{
"lessThanOrEqual": "Release 3DEXPERIENCE R2022x.FP.CFA.2424",
"status": "affected",
"version": "Release 3DEXPERIENCE R2022x Golden",
"versionType": "custom"
},
{
"lessThanOrEqual": "Release 3DEXPERIENCE R2023x.FP.CFA.2419",
"status": "affected",
"version": "Release 3DEXPERIENCE R2023x Golden",
"versionType": "custom"
},
{
"lessThanOrEqual": "Release 3DEXPERIENCE R2024x.FP.CFA.2424",
"status": "affected",
"version": "Release 3DEXPERIENCE R2024x Golden",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A reflected Cross-site Scripting (XSS) vulnerability affecting 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user\u0027s browser session."
}
],
"value": "A reflected Cross-site Scripting (XSS) vulnerability affecting 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user\u0027s browser session."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-27T08:09:32.404Z",
"orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
"shortName": "3DS"
},
"references": [
{
"url": "https://www.3ds.com/vulnerability/advisories"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Reflected Cross-site Scripting (XSS) vulnerability affecting 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
"assignerShortName": "3DS",
"cveId": "CVE-2024-6379",
"datePublished": "2024-08-20T13:44:53.360Z",
"dateReserved": "2024-06-27T08:00:00.939Z",
"dateUpdated": "2024-08-27T08:09:32.404Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-5598 (GCVE-0-2023-5598)
Vulnerability from cvelistv5 – Published: 2023-11-21 09:29 – Updated: 2024-08-02 08:07
VLAI
EPSS
VEX
Title
Stored Cross-site Scripting (XSS) vulnerabilities affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2023x
Summary
Stored Cross-site Scripting (XSS) vulnerabilities affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2023x allow an attacker to execute arbitrary script code.
Severity
5.4 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Dassault Systèmes | 3DSwymer |
Affected:
Release 3DEXPERIENCE R2022x Golden , ≤ Release 3DEXPERIENCE R2022x.FP.CFA.2337
(custom)
Affected: Release 3DEXPERIENCE R2023x Golden , ≤ Release 3DEXPERIENCE R2023x FP.CFA.2333 (custom) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T08:07:31.903Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.3ds.com/vulnerability/advisories"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "3DSwymer",
"vendor": "Dassault Syst\u00e8mes",
"versions": [
{
"lessThanOrEqual": "Release 3DEXPERIENCE R2022x.FP.CFA.2337",
"status": "affected",
"version": "Release 3DEXPERIENCE R2022x Golden",
"versionType": "custom"
},
{
"lessThanOrEqual": "Release 3DEXPERIENCE R2023x FP.CFA.2333",
"status": "affected",
"version": "Release 3DEXPERIENCE R2023x Golden",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Stored Cross-site Scripting (XSS) vulnerabilities affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2023x allow an attacker to execute arbitrary script code."
}
],
"value": "Stored Cross-site Scripting (XSS) vulnerabilities affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2023x allow an attacker to execute arbitrary script code."
}
],
"impacts": [
{
"capecId": "CAPEC-592",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-592 Stored XSS"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-11-29T09:25:56.435Z",
"orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
"shortName": "3DS"
},
"references": [
{
"url": "https://www.3ds.com/vulnerability/advisories"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Stored Cross-site Scripting (XSS) vulnerabilities affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2023x",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
"assignerShortName": "3DS",
"cveId": "CVE-2023-5598",
"datePublished": "2023-11-21T09:29:05.310Z",
"dateReserved": "2023-10-16T08:52:28.948Z",
"dateUpdated": "2024-08-02T08:07:31.903Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-5599 (GCVE-0-2023-5599)
Vulnerability from cvelistv5 – Published: 2023-11-21 09:28 – Updated: 2024-08-07 20:12
VLAI
EPSS
VEX
Title
Stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2023x
Summary
A stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2023x allows an attacker to execute arbitrary script code.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-07 20:12 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Dassault Systèmes | 3DSwymer |
Affected:
Release 3DEXPERIENCE R2022x Golden , ≤ Release 3DEXPERIENCE R2022x.FP.CFA.2337
(custom)
Affected: Release 3DEXPERIENCE R2023x Golden , ≤ Release 3DEXPERIENCE R2023x FP.CFA.2333 (custom) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T08:07:32.475Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.3ds.com/vulnerability/advisories"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-5599",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-07T20:12:47.560385Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-07T20:12:59.659Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "3DSwymer",
"vendor": "Dassault Syst\u00e8mes",
"versions": [
{
"lessThanOrEqual": "Release 3DEXPERIENCE R2022x.FP.CFA.2337",
"status": "affected",
"version": "Release 3DEXPERIENCE R2022x Golden",
"versionType": "custom"
},
{
"lessThanOrEqual": "Release 3DEXPERIENCE R2023x FP.CFA.2333",
"status": "affected",
"version": "Release 3DEXPERIENCE R2023x Golden",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2023x allows an attacker to execute arbitrary script code."
}
],
"value": "A stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2023x allows an attacker to execute arbitrary script code."
}
],
"impacts": [
{
"capecId": "CAPEC-592",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-592 Stored XSS"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-11-21T09:34:11.658Z",
"orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
"shortName": "3DS"
},
"references": [
{
"url": "https://www.3ds.com/vulnerability/advisories"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2023x",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
"assignerShortName": "3DS",
"cveId": "CVE-2023-5599",
"datePublished": "2023-11-21T09:28:35.458Z",
"dateReserved": "2023-10-16T08:52:33.048Z",
"dateUpdated": "2024-08-07T20:12:59.659Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-3589 (GCVE-0-2023-3589)
Vulnerability from cvelistv5 – Published: 2023-10-09 08:54 – Updated: 2024-09-19 14:58
VLAI
EPSS
VEX
Title
Cross-Site Request Forgery (CSRF) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x
Summary
A Cross-Site Request Forgery (CSRF) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x could allow with some very specific conditions an attacker to send a specifically crafted query to the server.
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-19 14:28 UTC
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
References
1 reference
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Dassault Systèmes | Teamwork Cloud - Business Edition |
Affected:
No Magic Release 2021x Golden , ≤ No Magic Release 2021x Refresh2
(custom)
Affected: No Magic Release 2022x Golden , ≤ No Magic Release 2022x Refresh2 (custom) |
|
| Dassault Systèmes | Teamwork Cloud - Enterprise Edition |
Affected:
No Magic Release 2021x Golden , ≤ No Magic Release 2021x Refresh2
(custom)
Affected: No Magic Release 2022x Golden , ≤ No Magic Release 2022x Refresh2 (custom) |
|
| Dassault Systèmes | Teamwork Cloud - Business Pro Edition |
Affected:
No Magic Release 2021x Golden , ≤ No Magic Release 2021x Refresh2
(custom)
Affected: No Magic Release 2022x Golden , ≤ No Magic Release 2022x Refresh2 (custom) |
|
| Dassault Systèmes | Teamwork Cloud - Standard Edition |
Affected:
No Magic Release 2021x Golden , ≤ No Magic Release 2021x Refresh2
(custom)
Affected: No Magic Release 2022x Golden , ≤ No Magic Release 2022x Refresh2 (custom) |
|
| dassult | teamwork_cloud_business_edition |
Affected:
no_magic_release_2021x_golden , ≤ no_magic_release_2021X_refresh2
(custom)
Affected: no_magic_release_2022x_golden , ≤ no_magic_release_2022x_refresh2 (custom) cpe:2.3:a:dassult:teamwork_cloud_business_edition:*:*:*:*:*:*:*:* |
|
| dassult | teamwork_cloud_business_pro_edition |
Affected:
no_magic_release_2021x_golden , ≤ no_magic_release_2021x_refresh2
(custom)
Affected: no_magic_release_2022x_golden , ≤ no_magic_release2022x_refresh2 (custom) cpe:2.3:a:dassult:teamwork_cloud_business_pro_edition:*:*:*:*:*:*:*:* |
|
| dassault | teamwork_cloud_standard_edition |
Affected:
no_magic_release_2021x_golden , ≤ no_magic_release_2021x_refresh2
(custom)
Affected: no_magic_release_2022x_golden , ≤ no_magic_release_2022x_refresh2 (custom) cpe:2.3:a:dassault:teamwork_cloud_standard_edition:*:*:*:*:*:*:*:* |
|
| dassault | teamwork_cloud_enterprise_edition |
Affected:
no_magic_release_2021x_golden , ≤ no_magic_release_2021_refresh2
(custom)
Affected: no_magic_release_2022x_golden , ≤ no_magic_release_2022_refresh2 (custom) cpe:2.3:a:dassault:teamwork_cloud_enterprise_edition:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T07:01:56.455Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.3ds.com/vulnerability/advisories"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:dassult:teamwork_cloud_business_edition:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "teamwork_cloud_business_edition",
"vendor": "dassult",
"versions": [
{
"lessThanOrEqual": "no_magic_release_2021X_refresh2",
"status": "affected",
"version": "no_magic_release_2021x_golden",
"versionType": "custom"
},
{
"lessThanOrEqual": "no_magic_release_2022x_refresh2",
"status": "affected",
"version": "no_magic_release_2022x_golden",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:dassult:teamwork_cloud_business_pro_edition:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "teamwork_cloud_business_pro_edition",
"vendor": "dassult",
"versions": [
{
"lessThanOrEqual": "no_magic_release_2021x_refresh2",
"status": "affected",
"version": "no_magic_release_2021x_golden",
"versionType": "custom"
},
{
"lessThanOrEqual": "no_magic_release2022x_refresh2",
"status": "affected",
"version": "no_magic_release_2022x_golden",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:dassault:teamwork_cloud_standard_edition:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "teamwork_cloud_standard_edition",
"vendor": "dassault",
"versions": [
{
"lessThanOrEqual": "no_magic_release_2021x_refresh2",
"status": "affected",
"version": "no_magic_release_2021x_golden",
"versionType": "custom"
},
{
"lessThanOrEqual": "no_magic_release_2022x_refresh2",
"status": "affected",
"version": "no_magic_release_2022x_golden",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:dassault:teamwork_cloud_enterprise_edition:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "teamwork_cloud_enterprise_edition",
"vendor": "dassault",
"versions": [
{
"lessThanOrEqual": "no_magic_release_2021_refresh2",
"status": "affected",
"version": "no_magic_release_2021x_golden",
"versionType": "custom"
},
{
"lessThanOrEqual": "no_magic_release_2022_refresh2",
"status": "affected",
"version": "no_magic_release_2022x_golden",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-3589",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-19T14:28:44.230042Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-19T14:58:42.152Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Teamwork Cloud - Business Edition",
"vendor": "Dassault Syst\u00e8mes",
"versions": [
{
"lessThanOrEqual": "No Magic Release 2021x Refresh2",
"status": "affected",
"version": "No Magic Release 2021x Golden",
"versionType": "custom"
},
{
"lessThanOrEqual": "No Magic Release 2022x Refresh2",
"status": "affected",
"version": "No Magic Release 2022x Golden",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Teamwork Cloud - Enterprise Edition",
"vendor": "Dassault Syst\u00e8mes",
"versions": [
{
"lessThanOrEqual": "No Magic Release 2021x Refresh2",
"status": "affected",
"version": "No Magic Release 2021x Golden",
"versionType": "custom"
},
{
"lessThanOrEqual": "No Magic Release 2022x Refresh2",
"status": "affected",
"version": "No Magic Release 2022x Golden",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Teamwork Cloud - Business Pro Edition",
"vendor": "Dassault Syst\u00e8mes",
"versions": [
{
"lessThanOrEqual": "No Magic Release 2021x Refresh2",
"status": "affected",
"version": "No Magic Release 2021x Golden",
"versionType": "custom"
},
{
"lessThanOrEqual": "No Magic Release 2022x Refresh2",
"status": "affected",
"version": "No Magic Release 2022x Golden",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Teamwork Cloud - Standard Edition",
"vendor": "Dassault Syst\u00e8mes",
"versions": [
{
"lessThanOrEqual": "No Magic Release 2021x Refresh2",
"status": "affected",
"version": "No Magic Release 2021x Golden",
"versionType": "custom"
},
{
"lessThanOrEqual": "No Magic Release 2022x Refresh2",
"status": "affected",
"version": "No Magic Release 2022x Golden",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Johannes R\u00fcckert from mgm security partners GmbH"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A Cross-Site Request Forgery (CSRF) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x could allow with some very specific conditions an attacker to send a specifically crafted query to the server."
}
],
"value": "A Cross-Site Request Forgery (CSRF) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x could allow with some very specific conditions an attacker to send a specifically crafted query to the server."
}
],
"impacts": [
{
"capecId": "CAPEC-62",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-62 Cross Site Request Forgery"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-13T09:15:26.671Z",
"orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
"shortName": "3DS"
},
"references": [
{
"url": "https://www.3ds.com/vulnerability/advisories"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Cross-Site Request Forgery (CSRF) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
"assignerShortName": "3DS",
"cveId": "CVE-2023-3589",
"datePublished": "2023-10-09T08:54:08.100Z",
"dateReserved": "2023-07-10T14:22:56.221Z",
"dateUpdated": "2024-09-19T14:58:42.152Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}