CVE-2023-1996

Summary

A reflected Cross-site Scripting (XSS) vulnerability in Release 3DEXPERIENCE R2018x through Release 3DEXPERIENCE R2023x allows an attacker to execute arbitrary script code.

Affected Software

VendorProductVersion RangeStatus
Dassault Systèmes3DEXPERIENCERelease 3DEXPERIENCE R2018x - All levelsaffected
Dassault Systèmes3DEXPERIENCERelease 3DEXPERIENCE R2019x - All levelsaffected
Dassault Systèmes3DEXPERIENCERelease 3DEXPERIENCE R2020x Golden <= Release 3DEXPERIENCE R2020x.FP.CFA.2303affected
Dassault Systèmes3DEXPERIENCERelease 3DEXPERIENCE R2021x Golden <= Release 3DEXPERIENCE R2021x.FP.CFA.2306affected
Dassault Systèmes3DEXPERIENCERelease 3DEXPERIENCE R2022x Golden <= Release 3DEXPERIENCE R2022x FP.CFA.2250affected
Dassault Systèmes3DEXPERIENCERelease 3DEXPERIENCE R2023x Golden <= Release 3DEXPERIENCE R2023x.FP.CFA.2306affected

Weaknesses

  • CWE-79: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References