Dassault Systèmes Security Advisories

Dassault Systèmes Security Advisories

Providing information on important security vulnerabilities that have been confirmed in our products.

Security advisories are based on published vulnerabilities coordinated with MITRE in accordance with MITRE CNA (CVE Numbering Authorities) policies and guidelines. Additional information on each advisory is available through our Support Knowledge Base (KB) that is referenced in the advisory notes. 

Published Date Updated Date CVE CVE Title CVE Details Affected Products Affected Versions Severity Notes 
2023-09-13   CVE-2023-3588 Stored Cross-site Scripting (XSS) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x A stored Cross-site Scripting (XSS) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x allows an attacker to execute arbitrary script code. Teamwork Cloud - Business Edition
Teamwork Cloud - Enterprise Edition
Teamwork Cloud - Business Pro Edition
Teamwork Cloud - Standard Edition
from No Magic Release 2021x through No Magic Release 2022x Medium Link to Support Knowledge Base (KB)
2023-08-28   CVE-2023-1997 OS Command Injection vulnerability affecting SIMULIA 3DOrchestrate from Release 3DEXPERIENCE R2021x through Release 3DEXPERIENCE R2023x An OS Command Injection vulnerability exists in SIMULIA 3DOrchestrate from Release 3DEXPERIENCE R2021x through Release 3DEXPERIENCE R2023x. A specially crafted HTTP request can lead to arbitrary command execution. SIMULIA 3DOrchestrate from Release 3DEXPERIENCE R2021x through Release 3DEXPERIENCE R2023x High Link to Support Knowledge Base (KB)
2023-07-12   CVE-2023-2762 Use-After-Free vulnerability in SLDPRT file reading procedure affecting SOLIDWORKS Desktop from Release SOLIDWORKS 2021 through Release SOLIDWORKS 2023 Use-After-Free, Out-of-bounds Write and Heap-based Buffer Overflow vulnerabilities exist in the DWG and DXF file reading procedure in SOLIDWORKS Desktop from Release SOLIDWORKS 2021 through Release SOLIDWORKS 2023. These vulnerabilities could allow an attacker to execute arbitrary code  while opening a specially crafted DWG or DXF file. SOLIDWORKS Desktop from Release SOLIDWORKS 2021 through Release SOLIDWORKS 2023 High Link to Support Knowledge Base (KB)
2023-07-12   CVE-2023-2763

Use-After-Free, Out-of-bounds Write and Heap-based Buffer Overflow vulnerabilities exist in the DWG and DXF file reading procedure in SOLIDWORKS Desktop from Release SOLIDWORKS 2021 through Release SOLIDWORKS 2023

Use-After-Free, Out-of-bounds Write and Heap-based Buffer Overflow vulnerabilities exist in the DWG and DXF file reading procedure in SOLIDWORKS Desktop from Release SOLIDWORKS 2021 through Release SOLIDWORKS 2023. These vulnerabilities could allow an attacker to execute arbitrary code  while opening a specially crafted DWG or DXF file.

SOLIDWORKS Desktop from Release SOLIDWORKS 2021 through Release SOLIDWORKS 2023 High Link to Support Knowledge Base (KB)
2023-05-19 2023-07-12 CVE-2023-1996 Reflected Cross-site Scripting (XSS) vulnerability affecting Release 3DEXPERIENCE R2018x through Release 3DEXPERIENCE R2023x A reflected Cross-site Scripting (XSS) vulnerability in Release 3DEXPERIENCE R2018x through Release 3DEXPERIENCE R2023x allows an attacker to execute arbitrary script code. 3DEXPERIENCE from Release 3DEXPERIENCE R2018x through Release 3DEXPERIENCE R2023x Medium Link to Support Knowledge Base (KB)
2023-04-21   CVE-2023-2139 Reflected Cross-site Scripting vulnerability affecting DELMIA Apriso Release 2017 through Release 2022 A reflected Cross-site Scripting (XSS) Vulnerability in DELMIA Apriso Release 2017 through Release 2022 allows an attacker to execute arbitrary script code. DELMIA Apriso from Release 2017 through Release 2022 Medium Link to Support Knowledge Base (KB)
2023-04-21   CVE-2023-2140 Server-Side Request Forgery vulnerability affecting DELMIA Apriso Release 2017 through Release 2022 A Server-Side Request Forgery vulnerability in DELMIA Apriso Release  2017 through Release 2022 could allow an unauthenticated attacker to issue requests to arbitrary hosts on behalf of the server running the DELMIA Apriso application. DELMIA Apriso from Release 2017 through Release 2022 High Link to Support Knowledge Base (KB)
2023-04-21   CVE-2023-2141 Unsafe .NET object deserialization affecting DELMIA Apriso Release 2017 through Release 2022 An unsafe .NET object deserialization in DELMIA Apriso Release 2017 through Release 2022 could lead to post-authentication remote code execution. DELMIA Apriso from Release 2017 through Release 2022 High Link to Support Knowledge Base (KB)
2023-03-09 2023-03-20 CVE-2023-1287 ENOVIA Live Collaboration V6R2013xE is affected by an XSL template injection vulnerability. An XSL template vulnerability in ENOVIA Live Collaboration V6R2013xE allows Remote Code Execution. ENOVIA Live Collaboration from V6R2013xE Golden through V6R2013xE FP.CFA.2228 Critical

Link to Support Knowledge Base (KB)

 

2023-03-09 2023-03-20 CVE-2023-1288 ENOVIA Live Collaboration V6R2013xE is affected by an XML External Entity injection (XXE) vulnerability. An XML External Entity injection (XXE) vulnerability in ENOVIA Live Collaboration V6R2013xE allows an attacker to read local files on the server. ENOVIA Live Collaboration from V6R2013xE Golden through V6R2013xE FP.CFA.2228 Medium

Link to Support Knowledge Base (KB)