CVE-2023-1996 - OpenCVE

A reflected Cross-site Scripting (XSS) vulnerability in Release 3DEXPERIENCE R2018x through Release 3DEXPERIENCE R2023x allows an attacker to execute arbitrary script code.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
3ds	3dexperience

Configuration 1 [-]

cpe:2.3:a:3ds:3dexperience:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.3ds.com/vulnerability/advisories

History

No history.

MITRE

Status: PUBLISHED

Assigner: 3DS

Published: 2023-05-19T16:37:20.133Z

Updated: 2024-08-02T06:05:27.108Z

Reserved: 2023-04-12T09:28:12.107Z

Link: CVE-2023-1996

Vulnrichment

No data.

NVD

Status : Modified

Published: 2023-05-19T17:15:09.097

Modified: 2023-07-12T08:15:09.827

Link: CVE-2023-1996

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-1996", "assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433", "state": "PUBLISHED", "assignerShortName": "3DS", "dateReserved": "2023-04-12T09:28:12.107Z", "datePublished": "2023-05-19T16:37:20.133Z", "dateUpdated": "2024-08-02T06:05:27.108Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433", "shortName": "3DS", "dateUpdated": "2023-07-12T07:19:15.343Z"}, "title": "Reflected Cross-site Scripting (XSS) vulnerability affecting Release 3DEXPERIENCE R2018x through Release 3DEXPERIENCE R2023x", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-591", "descriptions": [{"lang": "en", "value": "CAPEC-591 Reflected XSS"}]}], "affected": [{"vendor": "Dassault Syst\u00e8mes", "product": "3DEXPERIENCE", "versions": [{"status": "affected", "version": "Release 3DEXPERIENCE R2018x - All levels"}, {"status": "affected", "version": "Release 3DEXPERIENCE R2019x - All levels"}, {"status": "affected", "version": "Release 3DEXPERIENCE R2020x Golden", "lessThanOrEqual": "Release 3DEXPERIENCE R2020x.FP.CFA.2303", "versionType": "custom"}, {"status": "affected", "version": "Release 3DEXPERIENCE R2021x Golden", "lessThanOrEqual": "Release 3DEXPERIENCE R2021x.FP.CFA.2306", "versionType": "custom"}, {"status": "affected", "version": "Release 3DEXPERIENCE R2022x Golden", "lessThanOrEqual": "Release 3DEXPERIENCE R2022x FP.CFA.2250", "versionType": "custom"}, {"status": "affected", "version": "Release 3DEXPERIENCE R2023x Golden", "lessThanOrEqual": "Release 3DEXPERIENCE R2023x.FP.CFA.2306", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "A reflected Cross-site Scripting (XSS) vulnerability in Release 3DEXPERIENCE R2018x through Release 3DEXPERIENCE R2023x allows an attacker to execute arbitrary script code.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A reflected Cross-site Scripting (XSS) vulnerability in Release 3DEXPERIENCE R2018x through Release 3DEXPERIENCE R2023x allows an attacker to execute arbitrary script code."}]}], "references": [{"url": "https://www.3ds.com/vulnerability/advisories"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "credits": [{"lang": "en", "value": "Bhashit Pandya from Ownux Global", "user": "00000000-0000-4000-9000-000000000000", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T06:05:27.108Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.3ds.com/vulnerability/advisories", "tags": ["x_transferred"]}]}]}}