Post-authentication Unsafe .NET object deserialization vulnerability affecting DELMIA Apriso Release 2019 through Release 2024
CVE-2024-3301

8.5HIGH

Key Information:

Vendor

Dassault Systèmes

Status
Delmia Apriso
Vendor
CVE Published:
30 May 2024

What is CVE-2024-3301?

An unsafe .NET object deserialization flaw exists in DELMIA Apriso versions ranging from 2019 through 2024. This vulnerability can be exploited to execute arbitrary code on the system after authentication, potentially allowing an attacker to gain unauthorized access and control over affected installations. Users of DELMIA Apriso are advised to apply available security updates promptly to mitigate the risks associated with this vulnerability.

Affected Version(s)

DELMIA Apriso Release 2019 Golden

DELMIA Apriso Release 2020 Golden

DELMIA Apriso Release 2021 Golden

References

https://www.3ds.com/vulnerability/advisories

EPSS Score

9% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mehdi Elyassa of Synacktiv
.