FKIE_CVE-2023-3589

Vulnerability from fkie_nvd - Published: 2023-10-09 09:15 - Updated: 2026-06-17 06:14
Severity
6.8 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
A Cross-Site Request Forgery (CSRF) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x could allow with some very specific conditions an attacker to send a specifically crafted query to the server.
References
3DS.Information-Security@3ds.comhttps://www.3ds.com/vulnerability/advisoriesIssue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.3ds.com/vulnerability/advisoriesIssue Tracking, Vendor Advisory
Impacted products
Vendor Product Version
3ds teamwork_cloud_no_magic_release 2021x
3ds teamwork_cloud_no_magic_release 2022x
3ds teamwork_cloud_no_magic_release 2021x
3ds teamwork_cloud_no_magic_release 2022x
3ds teamwork_cloud_no_magic_release 2021x
3ds teamwork_cloud_no_magic_release 2022x
3ds teamwork_cloud_no_magic_release 2021x
3ds teamwork_cloud_no_magic_release 2022x
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Teamwork Cloud - Business Edition",
          "vendor": "Dassault Syst\u00e8mes",
          "versions": [
            {
              "lessThanOrEqual": "No Magic Release 2021x Refresh2",
              "status": "affected",
              "version": "No Magic Release 2021x Golden",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "No Magic Release 2022x Refresh2",
              "status": "affected",
              "version": "No Magic Release 2022x Golden",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Teamwork Cloud - Enterprise Edition",
          "vendor": "Dassault Syst\u00e8mes",
          "versions": [
            {
              "lessThanOrEqual": "No Magic Release 2021x Refresh2",
              "status": "affected",
              "version": "No Magic Release 2021x Golden",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "No Magic Release 2022x Refresh2",
              "status": "affected",
              "version": "No Magic Release 2022x Golden",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Teamwork Cloud - Business Pro Edition",
          "vendor": "Dassault Syst\u00e8mes",
          "versions": [
            {
              "lessThanOrEqual": "No Magic Release 2021x Refresh2",
              "status": "affected",
              "version": "No Magic Release 2021x Golden",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "No Magic Release 2022x Refresh2",
              "status": "affected",
              "version": "No Magic Release 2022x Golden",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Teamwork Cloud - Standard Edition",
          "vendor": "Dassault Syst\u00e8mes",
          "versions": [
            {
              "lessThanOrEqual": "No Magic Release 2021x Refresh2",
              "status": "affected",
              "version": "No Magic Release 2021x Golden",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "No Magic Release 2022x Refresh2",
              "status": "affected",
              "version": "No Magic Release 2022x Golden",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "3DS.Information-Security@3ds.com"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:dassult:teamwork_cloud_business_edition:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "teamwork_cloud_business_edition",
          "vendor": "dassult",
          "versions": [
            {
              "lessThanOrEqual": "no_magic_release_2021X_refresh2",
              "status": "affected",
              "version": "no_magic_release_2021x_golden",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "no_magic_release_2022x_refresh2",
              "status": "affected",
              "version": "no_magic_release_2022x_golden",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:dassult:teamwork_cloud_business_pro_edition:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "teamwork_cloud_business_pro_edition",
          "vendor": "dassult",
          "versions": [
            {
              "lessThanOrEqual": "no_magic_release_2021x_refresh2",
              "status": "affected",
              "version": "no_magic_release_2021x_golden",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "no_magic_release2022x_refresh2",
              "status": "affected",
              "version": "no_magic_release_2022x_golden",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:dassault:teamwork_cloud_standard_edition:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "teamwork_cloud_standard_edition",
          "vendor": "dassault",
          "versions": [
            {
              "lessThanOrEqual": "no_magic_release_2021x_refresh2",
              "status": "affected",
              "version": "no_magic_release_2021x_golden",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "no_magic_release_2022x_refresh2",
              "status": "affected",
              "version": "no_magic_release_2022x_golden",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:dassault:teamwork_cloud_enterprise_edition:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "teamwork_cloud_enterprise_edition",
          "vendor": "dassault",
          "versions": [
            {
              "lessThanOrEqual": "no_magic_release_2021_refresh2",
              "status": "affected",
              "version": "no_magic_release_2021x_golden",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "no_magic_release_2022_refresh2",
              "status": "affected",
              "version": "no_magic_release_2022x_golden",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:3ds:teamwork_cloud_no_magic_release:2021x:*:*:*:business:*:*:*",
              "matchCriteriaId": "E3465527-6062-4671-932F-5AC8CB6CAE76",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:3ds:teamwork_cloud_no_magic_release:2022x:*:*:*:business:*:*:*",
              "matchCriteriaId": "CBED6A07-495A-45E2-8670-6D0093E4E332",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:3ds:teamwork_cloud_no_magic_release:2021x:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "CC55035D-9D34-4B26-9B89-BEF735AF0465",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:3ds:teamwork_cloud_no_magic_release:2022x:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "BFEB98EE-3955-4A58-ACEE-59DDE97AFA34",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:3ds:teamwork_cloud_no_magic_release:2021x:*:*:*:business_pro:*:*:*",
              "matchCriteriaId": "2E7ADE53-CDAC-4135-A452-C81289828F47",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:3ds:teamwork_cloud_no_magic_release:2022x:*:*:*:business_pro:*:*:*",
              "matchCriteriaId": "5F10E179-1EAA-4C34-96DE-197F82EE2CA1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:3ds:teamwork_cloud_no_magic_release:2021x:*:*:*:standard:*:*:*",
              "matchCriteriaId": "D1BBE2EE-6042-4F9C-A423-5BF8C58757F0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:3ds:teamwork_cloud_no_magic_release:2022x:*:*:*:standard:*:*:*",
              "matchCriteriaId": "18C200BF-E20D-4FB7-83EA-24DBFA01D0BB",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Cross-Site Request Forgery (CSRF) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x could allow with some very specific conditions an attacker to send a specifically crafted query to the server."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de Cross-Site Request Forgery (CSRF) que afecta a Teamwork Cloud desde No Magic Release 2021x hasta No Magic Release 2022x podr\u00eda permitir, con algunas condiciones muy espec\u00edficas, que un atacante env\u00ede una consulta espec\u00edficamente manipulada al servidor."
    }
  ],
  "id": "CVE-2023-3589",
  "lastModified": "2026-06-17T06:14:24.940",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 5.2,
        "source": "3DS.Information-Security@3ds.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-3589",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-09-19T14:28:44.230042Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2023-10-09T09:15:10.507",
  "references": [
    {
      "source": "3DS.Information-Security@3ds.com",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "url": "https://www.3ds.com/vulnerability/advisories"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "url": "https://www.3ds.com/vulnerability/advisories"
    }
  ],
  "sourceIdentifier": "3DS.Information-Security@3ds.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ],
      "source": "3DS.Information-Security@3ds.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.