CVE-2023-2141 - Vulnerability Details - OpenCVE

An unsafe .NET object deserialization in DELMIA Apriso Release 2017 through Release 2022 could lead to post-authentication remote code execution.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
3ds	Delmia Apriso

Configuration 1 [-]

cpe:2.3:a:3ds:delmia_apriso:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.3ds.com/vulnerability/advisories

History

Tue, 04 Feb 2025 21:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: 3DS

Published: 2023-04-21T15:48:39.800Z

Updated: 2025-02-04T20:26:49.843Z

Reserved: 2023-04-18T07:52:31.574Z

Link: CVE-2023-2141

Vulnrichment

Updated: 2024-08-02T06:12:20.488Z

NVD

Status : Modified

Published: 2023-04-21T16:15:07.443

Modified: 2024-11-21T07:58:00.923

Link: CVE-2023-2141

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-2141", "assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433", "state": "PUBLISHED", "assignerShortName": "3DS", "dateReserved": "2023-04-18T07:52:31.574Z", "datePublished": "2023-04-21T15:48:39.800Z", "dateUpdated": "2025-02-04T20:26:49.843Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433", "shortName": "3DS", "dateUpdated": "2023-04-21T15:48:39.800Z"}, "title": "Unsafe .NET object deserialization affecting DELMIA Apriso Release 2017 through Release 2022 ", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-586", "descriptions": [{"lang": "en", "value": "CAPEC-586 Object Injection"}]}], "affected": [{"vendor": "Dassault Syst\u00e8mes", "product": "DELMIA Apriso", "versions": [{"status": "affected", "version": "Apriso 2017 Golden", "lessThanOrEqual": "Apriso 2017 SP7", "versionType": "custom"}, {"status": "affected", "version": "Apriso 2018 Golden", "lessThanOrEqual": "Apriso 2018 SP4", "versionType": "custom"}, {"status": "affected", "version": "Apriso 2019 Golden", "lessThanOrEqual": "Apriso 2019 SP5", "versionType": "custom"}, {"status": "affected", "version": "Apriso 2020 Golden", "lessThanOrEqual": "Apriso 2020 SP4", "versionType": "custom"}, {"status": "affected", "version": "Apriso 2021 Golden", "lessThanOrEqual": "Apriso 2021 SP2", "versionType": "custom"}, {"status": "affected", "version": "Apriso 2022 Golden"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "An unsafe .NET object deserialization in DELMIA Apriso Release 2017 through Release 2022 could lead to post-authentication remote code execution.\n", "supportingMedia": [{"type": "text/html", "base64": false, "value": "An unsafe .NET object deserialization in DELMIA Apriso Release 2017 through Release 2022 could lead to post-authentication remote code execution.<br>"}]}], "references": [{"url": "https://www.3ds.com/vulnerability/advisories"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 8.5, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H"}}], "credits": [{"lang": "en", "value": "Mehdi Elyassa and Vincent Herbulot from Synacktiv", "user": "00000000-0000-4000-9000-000000000000", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T06:12:20.488Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.3ds.com/vulnerability/advisories", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-04T20:26:47.042599Z", "id": "CVE-2023-2141", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-04T20:26:49.843Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.3ds.com/vulnerability/advisories", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T06:12:20.488Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-2141", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-02-04T20:26:47.042599Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-04T19:58:38.447Z"}}], "cna": {"title": "Unsafe .NET object deserialization affecting DELMIA Apriso Release 2017 through Release 2022 ", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Mehdi Elyassa and Vincent Herbulot from Synacktiv"}], "impacts": [{"capecId": "CAPEC-586", "descriptions": [{"lang": "en", "value": "CAPEC-586 Object Injection"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Dassault Syst\u00e8mes", "product": "DELMIA Apriso", "versions": [{"status": "affected", "version": "Apriso 2017 Golden", "versionType": "custom", "lessThanOrEqual": "Apriso 2017 SP7"}, {"status": "affected", "version": "Apriso 2018 Golden", "versionType": "custom", "lessThanOrEqual": "Apriso 2018 SP4"}, {"status": "affected", "version": "Apriso 2019 Golden", "versionType": "custom", "lessThanOrEqual": "Apriso 2019 SP5"}, {"status": "affected", "version": "Apriso 2020 Golden", "versionType": "custom", "lessThanOrEqual": "Apriso 2020 SP4"}, {"status": "affected", "version": "Apriso 2021 Golden", "versionType": "custom", "lessThanOrEqual": "Apriso 2021 SP2"}, {"status": "affected", "version": "Apriso 2022 Golden"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.3ds.com/vulnerability/advisories"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "An unsafe .NET object deserialization in DELMIA Apriso Release 2017 through Release 2022 could lead to post-authentication remote code execution.\n", "supportingMedia": [{"type": "text/html", "value": "An unsafe .NET object deserialization in DELMIA Apriso Release 2017 through Release 2022 could lead to post-authentication remote code execution.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data"}]}], "providerMetadata": {"orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433", "shortName": "3DS", "dateUpdated": "2023-04-21T15:48:39.800Z"}}}, "cveMetadata": {"cveId": "CVE-2023-2141", "state": "PUBLISHED", "dateUpdated": "2025-02-04T20:26:49.843Z", "dateReserved": "2023-04-18T07:52:31.574Z", "assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433", "datePublished": "2023-04-21T15:48:39.800Z", "assignerShortName": "3DS"}, "dataVersion": "5.1"}