3ds.com
https://www.3ds.com/vulnerability/advisories CVE-2024-3300
CRITICALNuclei
Pre-authentication Unsafe .NET object deserialization vulnerability affecting DELMIA Apriso Release 2019 through Release 2024
Record summary
CVE-2024-3300 has a selected CVSS score of 9.0 (critical); EIP currently links 1 Nuclei template.
Description
An unsafe .NET object deserialization vulnerability in DELMIA Apriso Release 2019 through Release 2024 could lead to pre-authentication remote code execution.
Description source: CVE List
Exploitation context
Available material
- Nuclei templates
- 1
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated May 30, 2024 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
delmia_aprisoBrowse 3ds / delmia_aprisoDefault status: unknown | CVE List | release_2019_golden to ≤ release_2019_sp5 | affected |
| release_2020_golden to ≤ release_2020_sp4 | affected | ||
| release_2021_golden to ≤ release_2021_sp3 | affected | ||
| release_2022_golden to ≤ release_2022_sp3 | affected | ||
| release_2023_golden to ≤ release_2023_sp2 | affected | ||
| release_2024_golden to ≤ release_2024_sp1 | affected | ||
DELMIA AprisoBrowse Dassault Systèmes / DELMIA AprisoDefault status: unaffected | CVE List | Release 2019 Golden to ≤ Release 2019 SP5 | affected |
| Release 2020 Golden to ≤ Release 2020 SP4 | affected | ||
| Release 2021 Golden to ≤ Release 2021 SP3 | affected | ||
| Release 2022 Golden to ≤ Release 2022 SP3 | affected | ||
| Release 2023 Golden to ≤ Release 2023 SP2 | affected | ||
| Release 2024 Golden to ≤ Release 2024 SP1 | affected |
Nuclei templates
1ProjectDiscoveryCRITICALDelmia Apriso - Pre-Authentication Unsafe .NET Object DeserializationCVSS 9
An unsafe .NET object deserialization vulnerability in DELMIA Apriso Release 2019 through Release 2024 could lead to pre-authentication remote code execution.
Impact
Attackers can exploit unsafe .NET object deserialization to achieve pre-authentication remote code execution.
Remediation
Update DELMIA Apriso to a version that addresses the unsafe deserialization vulnerability.
WeaknessesCWE-502
Authorsiamnoooob, rootxharsh, pdresearch
Template tagscvecve2024delmiaaprisorcevuln
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Shodan: html:"/apriso/"
https://www.synacktiv.com/en/advisories/multiple-vulnerabilities-in-delmia-apriso-2019-to-2024 https://www.3ds.com/vulnerability/advisories
Source: ProjectDiscovery