CVE-2024-6380 - OpenCVE

A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Dassult	Enovia Collaborative Industry Innovator

No data.

No data.

References

Link	Providers
https://www.3ds.com/vulnerability/advisories

History

Wed, 16 Oct 2024 17:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Dassult Dassult enovia Collaborative Industry Innovator
CPEs		cpe:2.3:a:dassult:enovia_collaborative_industry_innovator::::::::
Vendors & Products		Dassult Dassult enovia Collaborative Industry Innovator
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 16 Oct 2024 11:45:00 +0000

Type	Values Removed	Values Added
Description		A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
Title		Reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x
Weaknesses		CWE-79
References		https://www.3ds.com/vulnerability/advisories
Metrics		cvssV3_1 `{'score': 8.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N'}`

MITRE

Status: PUBLISHED

Assigner: 3DS

Published: 2024-10-16T11:28:28.769Z

Updated: 2024-10-16T16:18:04.990Z

Reserved: 2024-06-27T08:01:26.423Z

Link: CVE-2024-6380

Vulnrichment

Updated: 2024-10-16T16:17:55.407Z

NVD

Status : Awaiting Analysis

Published: 2024-10-16T12:15:08.767

Modified: 2024-10-16T16:38:14.557

Link: CVE-2024-6380

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-6380", "assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433", "state": "PUBLISHED", "assignerShortName": "3DS", "dateReserved": "2024-06-27T08:01:26.423Z", "datePublished": "2024-10-16T11:28:28.769Z", "dateUpdated": "2024-10-16T16:18:04.990Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433", "shortName": "3DS", "dateUpdated": "2024-10-16T11:28:28.769Z"}, "title": "Reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "type": "CWE"}]}], "affected": [{"vendor": "Dassault Syst\u00e8mes", "product": "ENOVIA Collaborative Industry Innovator", "versions": [{"status": "affected", "version": "Release 3DEXPERIENCE R2022x Golden", "lessThanOrEqual": "Release 3DEXPERIENCE R2022x.FP.CFA.2424", "versionType": "custom"}, {"status": "affected", "version": "Release 3DEXPERIENCE R2023x Golden", "lessThanOrEqual": "Release 3DEXPERIENCE R2023x.FP.CFA.2428", "versionType": "custom"}, {"status": "affected", "version": "Release 3DEXPERIENCE R2024x Golden", "lessThanOrEqual": "Release 3DEXPERIENCE R2024x.FP.CFA.2432", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session."}]}], "references": [{"url": "https://www.3ds.com/vulnerability/advisories"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseSeverity": "HIGH", "baseScore": 8.7, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N"}}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"affected": [{"vendor": "dassult", "product": "enovia_collaborative_industry_innovator", "cpes": ["cpe:2.3:a:dassult:enovia_collaborative_industry_innovator:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "Release 3DEXPERIENCE R2022x Golden", "status": "affected", "lessThanOrEqual": "Release 3DEXPERIENCE R2022x.FP.CFA.2424", "versionType": "custom"}, {"version": "Release 3DEXPERIENCE R2023x Golden <= Release", "status": "affected", "lessThanOrEqual": "Release 3DEXPERIENCE R2023x.FP.CFA.2428", "versionType": "custom"}, {"version": "3DEXPERIENCE R2024x Golden", "status": "affected", "lessThanOrEqual": "Release 3DEXPERIENCE R2024x.FP.CFA.2432", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-16T16:12:37.625779Z", "id": "CVE-2024-6380", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-16T16:18:04.990Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-6380", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-10-16T16:12:37.625779Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:dassult:enovia_collaborative_industry_innovator:*:*:*:*:*:*:*:*"], "vendor": "dassult", "product": "enovia_collaborative_industry_innovator", "versions": [{"status": "affected", "version": "Release 3DEXPERIENCE R2022x Golden", "versionType": "custom", "lessThanOrEqual": "Release 3DEXPERIENCE R2022x.FP.CFA.2424"}, {"status": "affected", "version": "Release 3DEXPERIENCE R2023x Golden <= Release", "versionType": "custom", "lessThanOrEqual": "Release 3DEXPERIENCE R2023x.FP.CFA.2428"}, {"status": "affected", "version": "3DEXPERIENCE R2024x Golden", "versionType": "custom", "lessThanOrEqual": "Release 3DEXPERIENCE R2024x.FP.CFA.2432"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-16T16:17:55.407Z"}}], "cna": {"title": "Reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x", "source": {"discovery": "EXTERNAL"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Dassault Syst\u00e8mes", "product": "ENOVIA Collaborative Industry Innovator", "versions": [{"status": "affected", "version": "Release 3DEXPERIENCE R2022x Golden", "versionType": "custom", "lessThanOrEqual": "Release 3DEXPERIENCE R2022x.FP.CFA.2424"}, {"status": "affected", "version": "Release 3DEXPERIENCE R2023x Golden", "versionType": "custom", "lessThanOrEqual": "Release 3DEXPERIENCE R2023x.FP.CFA.2428"}, {"status": "affected", "version": "Release 3DEXPERIENCE R2024x Golden", "versionType": "custom", "lessThanOrEqual": "Release 3DEXPERIENCE R2024x.FP.CFA.2432"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.3ds.com/vulnerability/advisories"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.", "supportingMedia": [{"type": "text/html", "value": "A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433", "shortName": "3DS", "dateUpdated": "2024-10-16T11:28:28.769Z"}}}, "cveMetadata": {"cveId": "CVE-2024-6380", "state": "PUBLISHED", "dateUpdated": "2024-10-16T16:18:04.990Z", "dateReserved": "2024-06-27T08:01:26.423Z", "assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433", "datePublished": "2024-10-16T11:28:28.769Z", "assignerShortName": "3DS"}, "dataVersion": "5.1"}