Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    4 vulnerabilities by dassult

    CVE-2024-6380 (GCVE-0-2024-6380)

    Vulnerability from nvd – Published: 2024-10-16 11:28 – Updated: 2024-10-16 16:18
    VLAI
    Title
    Reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x
    Summary
    A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
    Severity
    8.7 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-10-16 16:12 UTC
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
    Assigner
    References
    Impacted products
    Vendor Product Version
    Dassault Systèmes ENOVIA Collaborative Industry Innovator Affected: Release 3DEXPERIENCE R2022x Golden , ≤ Release 3DEXPERIENCE R2022x.FP.CFA.2424 (custom)
    Affected: Release 3DEXPERIENCE R2023x Golden , ≤ Release 3DEXPERIENCE R2023x.FP.CFA.2428 (custom)
    Affected: Release 3DEXPERIENCE R2024x Golden , ≤ Release 3DEXPERIENCE R2024x.FP.CFA.2432 (custom)
    		Create a notification for this product.
    dassult enovia_collaborative_industry_innovator Affected: Release 3DEXPERIENCE R2022x Golden , ≤ Release 3DEXPERIENCE R2022x.FP.CFA.2424 (custom)
    Affected: Release 3DEXPERIENCE R2023x Golden <= Release , ≤ Release 3DEXPERIENCE R2023x.FP.CFA.2428 (custom)
    Affected: 3DEXPERIENCE R2024x Golden , ≤ Release 3DEXPERIENCE R2024x.FP.CFA.2432 (custom)
        cpe:2.3:a:dassult:enovia_collaborative_industry_innovator:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:dassult:enovia_collaborative_industry_innovator:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "enovia_collaborative_industry_innovator",
            "vendor": "dassult",
            "versions": [
              {
                "lessThanOrEqual": "Release 3DEXPERIENCE R2022x.FP.CFA.2424",
                "status": "affected",
                "version": "Release 3DEXPERIENCE R2022x Golden",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "Release 3DEXPERIENCE R2023x.FP.CFA.2428",
                "status": "affected",
                "version": "Release 3DEXPERIENCE R2023x Golden \u003c= Release",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "Release 3DEXPERIENCE R2024x.FP.CFA.2432",
                "status": "affected",
                "version": "3DEXPERIENCE R2024x Golden",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-6380",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-16T16:12:37.625779Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-16T16:18:04.990Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ENOVIA Collaborative Industry Innovator",
          "vendor": "Dassault Syst\u00e8mes",
          "versions": [
            {
              "lessThanOrEqual": "Release 3DEXPERIENCE R2022x.FP.CFA.2424",
              "status": "affected",
              "version": "Release 3DEXPERIENCE R2022x Golden",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "Release 3DEXPERIENCE R2023x.FP.CFA.2428",
              "status": "affected",
              "version": "Release 3DEXPERIENCE R2023x Golden",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "Release 3DEXPERIENCE R2024x.FP.CFA.2432",
              "status": "affected",
              "version": "Release 3DEXPERIENCE R2024x Golden",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user\u0027s browser session."
            }
          ],
          "value": "A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user\u0027s browser session."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-16T11:28:28.769Z",
        "orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
        "shortName": "3DS"
      },
      "references": [
        {
          "url": "https://www.3ds.com/vulnerability/advisories"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
    "assignerShortName": "3DS",
    "cveId": "CVE-2024-6380",
    "datePublished": "2024-10-16T11:28:28.769Z",
    "dateReserved": "2024-06-27T08:01:26.423Z",
    "dateUpdated": "2024-10-16T16:18:04.990Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2023-3589 (GCVE-0-2023-3589)

    Vulnerability from nvd – Published: 2023-10-09 08:54 – Updated: 2024-09-19 14:58
    VLAI
    Title
    Cross-Site Request Forgery (CSRF) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x
    Summary
    A Cross-Site Request Forgery (CSRF) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x could allow with some very specific conditions an attacker to send a specifically crafted query to the server.
    Severity
    6.8 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-09-19 14:28 UTC
    CWE
    • CWE-352 - Cross-Site Request Forgery (CSRF)
    Assigner
    References
    Impacted products
    Vendor Product Version
    Dassault Systèmes Teamwork Cloud - Business Edition Affected: No Magic Release 2021x Golden , ≤ No Magic Release 2021x Refresh2 (custom)
    Affected: No Magic Release 2022x Golden , ≤ No Magic Release 2022x Refresh2 (custom)
    		Create a notification for this product.
    Dassault Systèmes Teamwork Cloud - Enterprise Edition Affected: No Magic Release 2021x Golden , ≤ No Magic Release 2021x Refresh2 (custom)
    Affected: No Magic Release 2022x Golden , ≤ No Magic Release 2022x Refresh2 (custom)
    		Create a notification for this product.
    Dassault Systèmes Teamwork Cloud - Business Pro Edition Affected: No Magic Release 2021x Golden , ≤ No Magic Release 2021x Refresh2 (custom)
    Affected: No Magic Release 2022x Golden , ≤ No Magic Release 2022x Refresh2 (custom)
    		Create a notification for this product.
    Dassault Systèmes Teamwork Cloud - Standard Edition Affected: No Magic Release 2021x Golden , ≤ No Magic Release 2021x Refresh2 (custom)
    Affected: No Magic Release 2022x Golden , ≤ No Magic Release 2022x Refresh2 (custom)
    		Create a notification for this product.
    dassult teamwork_cloud_business_edition Affected: no_magic_release_2021x_golden , ≤ no_magic_release_2021X_refresh2 (custom)
    Affected: no_magic_release_2022x_golden , ≤ no_magic_release_2022x_refresh2 (custom)
        cpe:2.3:a:dassult:teamwork_cloud_business_edition:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    dassult teamwork_cloud_business_pro_edition Affected: no_magic_release_2021x_golden , ≤ no_magic_release_2021x_refresh2 (custom)
    Affected: no_magic_release_2022x_golden , ≤ no_magic_release2022x_refresh2 (custom)
        cpe:2.3:a:dassult:teamwork_cloud_business_pro_edition:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    dassault teamwork_cloud_standard_edition Affected: no_magic_release_2021x_golden , ≤ no_magic_release_2021x_refresh2 (custom)
    Affected: no_magic_release_2022x_golden , ≤ no_magic_release_2022x_refresh2 (custom)
        cpe:2.3:a:dassault:teamwork_cloud_standard_edition:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    dassault teamwork_cloud_enterprise_edition Affected: no_magic_release_2021x_golden , ≤ no_magic_release_2021_refresh2 (custom)
    Affected: no_magic_release_2022x_golden , ≤ no_magic_release_2022_refresh2 (custom)
        cpe:2.3:a:dassault:teamwork_cloud_enterprise_edition:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Credits
    Johannes Rückert from mgm security partners GmbH
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T07:01:56.455Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.3ds.com/vulnerability/advisories"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:dassult:teamwork_cloud_business_edition:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "teamwork_cloud_business_edition",
            "vendor": "dassult",
            "versions": [
              {
                "lessThanOrEqual": "no_magic_release_2021X_refresh2",
                "status": "affected",
                "version": "no_magic_release_2021x_golden",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "no_magic_release_2022x_refresh2",
                "status": "affected",
                "version": "no_magic_release_2022x_golden",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:dassult:teamwork_cloud_business_pro_edition:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "teamwork_cloud_business_pro_edition",
            "vendor": "dassult",
            "versions": [
              {
                "lessThanOrEqual": "no_magic_release_2021x_refresh2",
                "status": "affected",
                "version": "no_magic_release_2021x_golden",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "no_magic_release2022x_refresh2",
                "status": "affected",
                "version": "no_magic_release_2022x_golden",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:dassault:teamwork_cloud_standard_edition:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "teamwork_cloud_standard_edition",
            "vendor": "dassault",
            "versions": [
              {
                "lessThanOrEqual": "no_magic_release_2021x_refresh2",
                "status": "affected",
                "version": "no_magic_release_2021x_golden",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "no_magic_release_2022x_refresh2",
                "status": "affected",
                "version": "no_magic_release_2022x_golden",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:dassault:teamwork_cloud_enterprise_edition:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "teamwork_cloud_enterprise_edition",
            "vendor": "dassault",
            "versions": [
              {
                "lessThanOrEqual": "no_magic_release_2021_refresh2",
                "status": "affected",
                "version": "no_magic_release_2021x_golden",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "no_magic_release_2022_refresh2",
                "status": "affected",
                "version": "no_magic_release_2022x_golden",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-3589",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-19T14:28:44.230042Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-19T14:58:42.152Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Teamwork Cloud - Business Edition",
          "vendor": "Dassault Syst\u00e8mes",
          "versions": [
            {
              "lessThanOrEqual": "No Magic Release 2021x Refresh2",
              "status": "affected",
              "version": "No Magic Release 2021x Golden",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "No Magic Release 2022x Refresh2",
              "status": "affected",
              "version": "No Magic Release 2022x Golden",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Teamwork Cloud - Enterprise Edition",
          "vendor": "Dassault Syst\u00e8mes",
          "versions": [
            {
              "lessThanOrEqual": "No Magic Release 2021x Refresh2",
              "status": "affected",
              "version": "No Magic Release 2021x Golden",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "No Magic Release 2022x Refresh2",
              "status": "affected",
              "version": "No Magic Release 2022x Golden",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Teamwork Cloud - Business Pro Edition",
          "vendor": "Dassault Syst\u00e8mes",
          "versions": [
            {
              "lessThanOrEqual": "No Magic Release 2021x Refresh2",
              "status": "affected",
              "version": "No Magic Release 2021x Golden",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "No Magic Release 2022x Refresh2",
              "status": "affected",
              "version": "No Magic Release 2022x Golden",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Teamwork Cloud - Standard Edition",
          "vendor": "Dassault Syst\u00e8mes",
          "versions": [
            {
              "lessThanOrEqual": "No Magic Release 2021x Refresh2",
              "status": "affected",
              "version": "No Magic Release 2021x Golden",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "No Magic Release 2022x Refresh2",
              "status": "affected",
              "version": "No Magic Release 2022x Golden",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Johannes R\u00fcckert from mgm security partners GmbH"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A Cross-Site Request Forgery (CSRF) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x could allow with some very specific conditions an attacker to send a specifically crafted query to the server."
            }
          ],
          "value": "A Cross-Site Request Forgery (CSRF) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x could allow with some very specific conditions an attacker to send a specifically crafted query to the server."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-62",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-62 Cross Site Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-13T09:15:26.671Z",
        "orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
        "shortName": "3DS"
      },
      "references": [
        {
          "url": "https://www.3ds.com/vulnerability/advisories"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Cross-Site Request Forgery (CSRF) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
    "assignerShortName": "3DS",
    "cveId": "CVE-2023-3589",
    "datePublished": "2023-10-09T08:54:08.100Z",
    "dateReserved": "2023-07-10T14:22:56.221Z",
    "dateUpdated": "2024-09-19T14:58:42.152Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2024-6380 (GCVE-0-2024-6380)

    Vulnerability from cvelistv5 – Published: 2024-10-16 11:28 – Updated: 2024-10-16 16:18
    VLAI
    Title
    Reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x
    Summary
    A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
    Severity
    8.7 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-10-16 16:12 UTC
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
    Assigner
    References
    Impacted products
    Vendor Product Version
    Dassault Systèmes ENOVIA Collaborative Industry Innovator Affected: Release 3DEXPERIENCE R2022x Golden , ≤ Release 3DEXPERIENCE R2022x.FP.CFA.2424 (custom)
    Affected: Release 3DEXPERIENCE R2023x Golden , ≤ Release 3DEXPERIENCE R2023x.FP.CFA.2428 (custom)
    Affected: Release 3DEXPERIENCE R2024x Golden , ≤ Release 3DEXPERIENCE R2024x.FP.CFA.2432 (custom)
    		Create a notification for this product.
    dassult enovia_collaborative_industry_innovator Affected: Release 3DEXPERIENCE R2022x Golden , ≤ Release 3DEXPERIENCE R2022x.FP.CFA.2424 (custom)
    Affected: Release 3DEXPERIENCE R2023x Golden <= Release , ≤ Release 3DEXPERIENCE R2023x.FP.CFA.2428 (custom)
    Affected: 3DEXPERIENCE R2024x Golden , ≤ Release 3DEXPERIENCE R2024x.FP.CFA.2432 (custom)
        cpe:2.3:a:dassult:enovia_collaborative_industry_innovator:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:dassult:enovia_collaborative_industry_innovator:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "enovia_collaborative_industry_innovator",
            "vendor": "dassult",
            "versions": [
              {
                "lessThanOrEqual": "Release 3DEXPERIENCE R2022x.FP.CFA.2424",
                "status": "affected",
                "version": "Release 3DEXPERIENCE R2022x Golden",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "Release 3DEXPERIENCE R2023x.FP.CFA.2428",
                "status": "affected",
                "version": "Release 3DEXPERIENCE R2023x Golden \u003c= Release",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "Release 3DEXPERIENCE R2024x.FP.CFA.2432",
                "status": "affected",
                "version": "3DEXPERIENCE R2024x Golden",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-6380",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-16T16:12:37.625779Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-16T16:18:04.990Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ENOVIA Collaborative Industry Innovator",
          "vendor": "Dassault Syst\u00e8mes",
          "versions": [
            {
              "lessThanOrEqual": "Release 3DEXPERIENCE R2022x.FP.CFA.2424",
              "status": "affected",
              "version": "Release 3DEXPERIENCE R2022x Golden",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "Release 3DEXPERIENCE R2023x.FP.CFA.2428",
              "status": "affected",
              "version": "Release 3DEXPERIENCE R2023x Golden",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "Release 3DEXPERIENCE R2024x.FP.CFA.2432",
              "status": "affected",
              "version": "Release 3DEXPERIENCE R2024x Golden",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user\u0027s browser session."
            }
          ],
          "value": "A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user\u0027s browser session."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-16T11:28:28.769Z",
        "orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
        "shortName": "3DS"
      },
      "references": [
        {
          "url": "https://www.3ds.com/vulnerability/advisories"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
    "assignerShortName": "3DS",
    "cveId": "CVE-2024-6380",
    "datePublished": "2024-10-16T11:28:28.769Z",
    "dateReserved": "2024-06-27T08:01:26.423Z",
    "dateUpdated": "2024-10-16T16:18:04.990Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2023-3589 (GCVE-0-2023-3589)

    Vulnerability from cvelistv5 – Published: 2023-10-09 08:54 – Updated: 2024-09-19 14:58
    VLAI
    Title
    Cross-Site Request Forgery (CSRF) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x
    Summary
    A Cross-Site Request Forgery (CSRF) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x could allow with some very specific conditions an attacker to send a specifically crafted query to the server.
    Severity
    6.8 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-09-19 14:28 UTC
    CWE
    • CWE-352 - Cross-Site Request Forgery (CSRF)
    Assigner
    References
    Impacted products
    Vendor Product Version
    Dassault Systèmes Teamwork Cloud - Business Edition Affected: No Magic Release 2021x Golden , ≤ No Magic Release 2021x Refresh2 (custom)
    Affected: No Magic Release 2022x Golden , ≤ No Magic Release 2022x Refresh2 (custom)
    		Create a notification for this product.
    Dassault Systèmes Teamwork Cloud - Enterprise Edition Affected: No Magic Release 2021x Golden , ≤ No Magic Release 2021x Refresh2 (custom)
    Affected: No Magic Release 2022x Golden , ≤ No Magic Release 2022x Refresh2 (custom)
    		Create a notification for this product.
    Dassault Systèmes Teamwork Cloud - Business Pro Edition Affected: No Magic Release 2021x Golden , ≤ No Magic Release 2021x Refresh2 (custom)
    Affected: No Magic Release 2022x Golden , ≤ No Magic Release 2022x Refresh2 (custom)
    		Create a notification for this product.
    Dassault Systèmes Teamwork Cloud - Standard Edition Affected: No Magic Release 2021x Golden , ≤ No Magic Release 2021x Refresh2 (custom)
    Affected: No Magic Release 2022x Golden , ≤ No Magic Release 2022x Refresh2 (custom)
    		Create a notification for this product.
    dassult teamwork_cloud_business_edition Affected: no_magic_release_2021x_golden , ≤ no_magic_release_2021X_refresh2 (custom)
    Affected: no_magic_release_2022x_golden , ≤ no_magic_release_2022x_refresh2 (custom)
        cpe:2.3:a:dassult:teamwork_cloud_business_edition:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    dassult teamwork_cloud_business_pro_edition Affected: no_magic_release_2021x_golden , ≤ no_magic_release_2021x_refresh2 (custom)
    Affected: no_magic_release_2022x_golden , ≤ no_magic_release2022x_refresh2 (custom)
        cpe:2.3:a:dassult:teamwork_cloud_business_pro_edition:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    dassault teamwork_cloud_standard_edition Affected: no_magic_release_2021x_golden , ≤ no_magic_release_2021x_refresh2 (custom)
    Affected: no_magic_release_2022x_golden , ≤ no_magic_release_2022x_refresh2 (custom)
        cpe:2.3:a:dassault:teamwork_cloud_standard_edition:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    dassault teamwork_cloud_enterprise_edition Affected: no_magic_release_2021x_golden , ≤ no_magic_release_2021_refresh2 (custom)
    Affected: no_magic_release_2022x_golden , ≤ no_magic_release_2022_refresh2 (custom)
        cpe:2.3:a:dassault:teamwork_cloud_enterprise_edition:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Credits
    Johannes Rückert from mgm security partners GmbH
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T07:01:56.455Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.3ds.com/vulnerability/advisories"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:dassult:teamwork_cloud_business_edition:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "teamwork_cloud_business_edition",
            "vendor": "dassult",
            "versions": [
              {
                "lessThanOrEqual": "no_magic_release_2021X_refresh2",
                "status": "affected",
                "version": "no_magic_release_2021x_golden",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "no_magic_release_2022x_refresh2",
                "status": "affected",
                "version": "no_magic_release_2022x_golden",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:dassult:teamwork_cloud_business_pro_edition:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "teamwork_cloud_business_pro_edition",
            "vendor": "dassult",
            "versions": [
              {
                "lessThanOrEqual": "no_magic_release_2021x_refresh2",
                "status": "affected",
                "version": "no_magic_release_2021x_golden",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "no_magic_release2022x_refresh2",
                "status": "affected",
                "version": "no_magic_release_2022x_golden",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:dassault:teamwork_cloud_standard_edition:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "teamwork_cloud_standard_edition",
            "vendor": "dassault",
            "versions": [
              {
                "lessThanOrEqual": "no_magic_release_2021x_refresh2",
                "status": "affected",
                "version": "no_magic_release_2021x_golden",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "no_magic_release_2022x_refresh2",
                "status": "affected",
                "version": "no_magic_release_2022x_golden",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:dassault:teamwork_cloud_enterprise_edition:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "teamwork_cloud_enterprise_edition",
            "vendor": "dassault",
            "versions": [
              {
                "lessThanOrEqual": "no_magic_release_2021_refresh2",
                "status": "affected",
                "version": "no_magic_release_2021x_golden",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "no_magic_release_2022_refresh2",
                "status": "affected",
                "version": "no_magic_release_2022x_golden",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-3589",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-19T14:28:44.230042Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-19T14:58:42.152Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Teamwork Cloud - Business Edition",
          "vendor": "Dassault Syst\u00e8mes",
          "versions": [
            {
              "lessThanOrEqual": "No Magic Release 2021x Refresh2",
              "status": "affected",
              "version": "No Magic Release 2021x Golden",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "No Magic Release 2022x Refresh2",
              "status": "affected",
              "version": "No Magic Release 2022x Golden",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Teamwork Cloud - Enterprise Edition",
          "vendor": "Dassault Syst\u00e8mes",
          "versions": [
            {
              "lessThanOrEqual": "No Magic Release 2021x Refresh2",
              "status": "affected",
              "version": "No Magic Release 2021x Golden",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "No Magic Release 2022x Refresh2",
              "status": "affected",
              "version": "No Magic Release 2022x Golden",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Teamwork Cloud - Business Pro Edition",
          "vendor": "Dassault Syst\u00e8mes",
          "versions": [
            {
              "lessThanOrEqual": "No Magic Release 2021x Refresh2",
              "status": "affected",
              "version": "No Magic Release 2021x Golden",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "No Magic Release 2022x Refresh2",
              "status": "affected",
              "version": "No Magic Release 2022x Golden",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Teamwork Cloud - Standard Edition",
          "vendor": "Dassault Syst\u00e8mes",
          "versions": [
            {
              "lessThanOrEqual": "No Magic Release 2021x Refresh2",
              "status": "affected",
              "version": "No Magic Release 2021x Golden",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "No Magic Release 2022x Refresh2",
              "status": "affected",
              "version": "No Magic Release 2022x Golden",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Johannes R\u00fcckert from mgm security partners GmbH"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A Cross-Site Request Forgery (CSRF) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x could allow with some very specific conditions an attacker to send a specifically crafted query to the server."
            }
          ],
          "value": "A Cross-Site Request Forgery (CSRF) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x could allow with some very specific conditions an attacker to send a specifically crafted query to the server."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-62",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-62 Cross Site Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-13T09:15:26.671Z",
        "orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
        "shortName": "3DS"
      },
      "references": [
        {
          "url": "https://www.3ds.com/vulnerability/advisories"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Cross-Site Request Forgery (CSRF) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
    "assignerShortName": "3DS",
    "cveId": "CVE-2023-3589",
    "datePublished": "2023-10-09T08:54:08.100Z",
    "dateReserved": "2023-07-10T14:22:56.221Z",
    "dateUpdated": "2024-09-19T14:58:42.152Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}