github - ghsa-xc69-c397-p3r8

GHSA-XC69-C397-P3R8

Vulnerability from github – Published: 2023-04-21 18:30 – Updated: 2024-04-04 03:38

Details

A Server-Side Request Forgery vulnerability in DELMIA Apriso Release 2017 through Release 2022

could allow an unauthenticated attacker to issue requests to arbitrary hosts on behalf of the server running the DELMIA Apriso application.

Severity ?

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-2140"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-04-21T16:15:07Z",
    "severity": "HIGH"
  },
  "details": "A Server-Side Request Forgery vulnerability in DELMIA Apriso Release  2017 through Release 2022 \n\ncould allow an unauthenticated attacker to issue requests to arbitrary hosts on behalf of the server running the DELMIA Apriso application.\n",
  "id": "GHSA-xc69-c397-p3r8",
  "modified": "2024-04-04T03:38:09Z",
  "published": "2023-04-21T18:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2140"
    },
    {
      "type": "WEB",
      "url": "https://www.3ds.com/vulnerability/advisories"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2023-2140 (GCVE-0-2023-2140)

Vulnerability from cvelistv5 – Published: 2023-04-21 15:48 – Updated: 2025-02-04 20:27

Summary

A Server-Side Request Forgery vulnerability in DELMIA Apriso Release 2017 through Release 2022 could allow an unauthenticated attacker to issue requests to arbitrary hosts on behalf of the server running the DELMIA Apriso application.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

3DS

References

URL

Tags

https://www.3ds.com/vulnerability/advisories

Impacted products

	Vendor	Product	Version
	Dassault Systèmes	DELMIA Apriso	Affected: Apriso 2017 Golden , ≤ Apriso 2017 SP7 (custom) Affected: Apriso 2018 Golden , ≤ Apriso 2018 SP4 (custom) Affected: Apriso 2019 Golden , ≤ Apriso 2019 SP5 (custom) Affected: Apriso 2020 Golden , ≤ Apriso 2020 SP4 (custom) Affected: Apriso 2021 Golden , ≤ Apriso 2021 SP2 (custom) Affected: Apriso 2022 Golden

Credits

Mehdi Elyassa and Vincent Herbulot from Synacktiv

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T06:12:20.445Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.3ds.com/vulnerability/advisories"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-2140",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-04T20:27:03.162173Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-04T20:27:09.654Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "DELMIA Apriso",
          "vendor": "Dassault Syst\u00e8mes",
          "versions": [
            {
              "lessThanOrEqual": "Apriso 2017 SP7",
              "status": "affected",
              "version": "Apriso 2017 Golden",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "Apriso 2018 SP4",
              "status": "affected",
              "version": "Apriso 2018 Golden",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "Apriso 2019 SP5",
              "status": "affected",
              "version": "Apriso 2019 Golden",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "Apriso 2020 SP4",
              "status": "affected",
              "version": "Apriso 2020 Golden",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "Apriso 2021 SP2",
              "status": "affected",
              "version": "Apriso 2021 Golden",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "Apriso 2022 Golden"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Mehdi Elyassa and Vincent Herbulot from Synacktiv"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eServer-Side Request Forgery vulnerability\u0026nbsp;\u003c/span\u003ein DELMIA Apriso\u0026nbsp;Release  2017 through Release 2022 \n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ecould allow an unauthenticated attacker to issue requests to arbitrary hosts on behalf of the server running the DELMIA Apriso application.\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "A Server-Side Request Forgery vulnerability in DELMIA Apriso Release  2017 through Release 2022 \n\ncould allow an unauthenticated attacker to issue requests to arbitrary hosts on behalf of the server running the DELMIA Apriso application.\n"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-664",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-664: Server Side Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-04-21T15:48:25.654Z",
        "orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
        "shortName": "3DS"
      },
      "references": [
        {
          "url": "https://www.3ds.com/vulnerability/advisories"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Server-Side Request Forgery vulnerability affecting DELMIA Apriso Release 2017 through Release 2022 ",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433",
    "assignerShortName": "3DS",
    "cveId": "CVE-2023-2140",
    "datePublished": "2023-04-21T15:48:25.654Z",
    "dateReserved": "2023-04-18T07:52:26.003Z",
    "dateUpdated": "2025-02-04T20:27:09.654Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-XC69-C397-P3R8

CVE-2023-2140 (GCVE-0-2023-2140)

Tags

Sightings

Nomenclature