​If an attacker tricks an admin user of PTC Codebeamer into clicking on a malicious link, it may allow the attacker to inject arbitrary code to be executed in the browser on the target device.
Advisories
Source ID Title
EUVD EUVD EUVD-2023-54167 ​If an attacker tricks an admin user of PTC Codebeamer into clicking on a malicious link, it may allow the attacker to inject arbitrary code to be executed in the browser on the target device.
Fixes

Solution

PTC recommends the following: * ​Version 22.10.X: upgrade to 22.10-SP8 https://intland.com/codebeamer-download/  or newer version * ​Version 22.04.X: upgrade to 22.04-SP6 https://intland.com/codebeamer-download/  or newer version * ​Version 21.09.X: upgrade to 21.09-SP14 https://intland.com/codebeamer-download/  or newer version ​Docker Image download: https://hub.docker.com/r/intland/codebeamer/tags https://hub.docker.com/r/intland/codebeamer/tags ​Codebeamer installers: https://intland.com/codebeamer-download/ https://intland.com/codebeamer-download/ ​Hosted customers may request an upgrade through the support channel https://codebeamer.com/cb/tracker/1910563 . ​Note that version 2.0 is not impacted by this vulnerability. ​For more information refer to PTC Security Advisory and Resolution https://codebeamer.com/cb/wiki/31346480 .


Workaround

No workaround given by the vendor.

History

Thu, 13 Feb 2025 17:15:00 +0000

Type Values Removed Values Added
Description ​If an attacker tricks an admin user of PTC Codebeamer into clicking on a malicious link, it may allow the attacker to inject arbitrary code to be executed in the browser on the target device. ​If an attacker tricks an admin user of PTC Codebeamer into clicking on a malicious link, it may allow the attacker to inject arbitrary code to be executed in the browser on the target device.

Thu, 16 Jan 2025 22:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}


cve-icon MITRE

Status: PUBLISHED

Assigner: icscert

Published:

Updated: 2025-02-13T17:13:13.160Z

Reserved: 2023-08-10T14:52:35.290Z

Link: CVE-2023-4296

cve-icon Vulnrichment

Updated: 2024-08-02T07:24:04.488Z

cve-icon NVD

Status : Modified

Published: 2023-08-29T22:15:09.297

Modified: 2025-02-13T17:17:17.657

Link: CVE-2023-4296

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.