by Kastro
Paper/Archive/CVE-2024-3300

CVE-2024-3300

Dassault Systèmes DELMIA Apriso — Pre-authentication Unsafe .NET object deserialization vulnerability affecting DELMIA Apriso Release 2019 through Release 2024

EPSS 3%CVSS 9.0
critical.is priorityof 100
44
CVSS 9.0 (CNA)9.0 / 10 × 3027.0Not in CISA KEV+300.0EPSS percentile 86.8.868 × 2017.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An unsafe .NET object deserialization vulnerability in DELMIA Apriso Release 2019 through Release 2024 could lead to pre-authentication remote code execution.

Affected

ProductAffectedFixed inSource
DELMIA AprisoRelease 2019 Golden – Release 2019 SP5–CNA
DELMIA AprisoRelease 2020 Golden – Release 2020 SP4–CNA
DELMIA AprisoRelease 2021 Golden – Release 2021 SP3–CNA
DELMIA AprisoRelease 2022 Golden – Release 2022 SP3–CNA
DELMIA AprisoRelease 2023 Golden – Release 2023 SP2–CNA
DELMIA AprisoRelease 2024 Golden – Release 2024 SP1–CNA
delmia_aprisorelease_2019_golden – release_2019_sp5–CISA-ADP
delmia_aprisorelease_2020_golden – release_2020_sp4–CISA-ADP
delmia_aprisorelease_2021_golden – release_2021_sp3–CISA-ADP
delmia_aprisorelease_2022_golden – release_2022_sp3–CISA-ADP
delmia_aprisorelease_2023_golden – release_2023_sp2–CISA-ADP
delmia_aprisorelease_2024_golden – release_2024_sp1–CISA-ADP

Scores by source

3DS (CNA)9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

ref3ds.com/vulnerability/advisories