CVE-2023-2140
Server-Side Request Forgery vulnerability affecting DELMIA Apriso Release 2017 through Release 2022
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
CISA's decision points: whether it is exploited, whether attacks can be automated, and how much control an attacker gets. Assessed (SSVC 2.0.3).What do these mean? →
- Exploitation: none
- Automatable: yes
- Technical impact: partial
Summary
A Server-Side Request Forgery vulnerability in DELMIA Apriso Release 2017 through Release 2022 could allow an unauthenticated attacker to issue requests to arbitrary hosts on behalf of the server running the DELMIA Apriso application.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- Dassault Systèmes DELMIA Apriso
From Apriso 2017 Golden · through Apriso 2017 SP7; From Apriso 2018 Golden · through Apriso 2018 SP4; From Apriso 2019 Golden · through Apriso 2019 SP5; From Apriso 2020 Golden · through Apriso 2020 SP4; From Apriso 2021 Golden · through Apriso 2021 SP2