Dassault Systèmes Security Advisories

Providing information on important security vulnerabilities that have been confirmed in our products.

Security advisories are based on published vulnerabilities coordinated with MITRE in accordance with MITRE CNA (CVE Numbering Authorities) policies and guidelines. Additional information on each advisory is available through our Support Knowledge Base (KB) that is referenced in the advisory notes. 

Published DateUpdated DateCVECVE TitleCVE DetailsAffected ProductsAffected VersionsSeverityNotes 
2024-09-19 CVE-2024-7737Stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xA stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.3DSwymerfrom Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xHighLink to Support Knowledge Base (KB)
2024-09-19 CVE-2024-7736Reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xA reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.ENOVIA Collaborative Industry Innovatorfrom Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xHighLink to Support Knowledge Base (KB)
2024-09-02 CVE-2024-8004Stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xA stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.ENOVIA Collaborative Industry Innovatorfrom Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xHighLink to Support Knowledge Base (KB)
2024-09-022024-09-13CVE-2024-7939Stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2024xA stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.3DSwymerRelease 3DEXPERIENCE R2024xHighLink to Support Knowledge Base (KB)
2024-09-02 CVE-2024-7938Stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024xA stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.3DSwymerfrom Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024xHighLink to Support Knowledge Base (KB)
2024-09-022024-09-13CVE-2024-7932Stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer on Release 3DEXPERIENCE R2024xA stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.3DSwymerRelease 3DEXPERIENCE R2024xHighLink to Support Knowledge Base (KB)
2024-08-202024-08-27CVE-2024-6379Reflected Cross-site Scripting (XSS) vulnerability affecting 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xA reflected Cross-site Scripting (XSS) vulnerability affecting 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.3DSwymerfrom Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xHighLink to Support Knowledge Base (KB)
2024-08-20 CVE-2024-6378Reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xA reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.ENOVIA Collaborative Industry Innovatorfrom Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xHighLink to Support Knowledge Base (KB)
2024-08-202024-08-27CVE-2024-6377URL redirection to untrusted site (open redirect) vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xAn URL redirection to untrusted site (open redirect) vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to redirect users to an arbitrary website via a crafted URL.3DSwymerfrom Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xHighLink to Support Knowledge Base (KB)
2024-05-30 CVE-2024-3301Post-authentication Unsafe .NET object deserialization vulnerability affecting DELMIA Apriso Release 2019 through Release 2024An unsafe .NET object deserialization vulnerability in DELMIA Apriso Release 2019 through Release 2024 could lead to post-authentication remote code execution.DELMIA Aprisofrom Release 2019 through Release 2024HighLink to Support Knowledge Base (KB)
2024-05-30 CVE-2024-3300Pre-authentication Unsafe .NET object deserialization vulnerability affecting DELMIA Apriso Release 2019 through Release 2024An unsafe .NET object deserialization vulnerability in DELMIA Apriso Release 2019 through Release 2024 could lead to pre-authentication remote code execution.DELMIA Aprisofrom Release 2019 through Release 2024CriticalLink to Support Knowledge Base (KB)
2024-05-17 CVE-2023-5597Stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024xA stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code.3DSwymerfrom Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024xMediumLink to Support Knowledge Base (KB)
2024-04-04 CVE-2024-3299Out-Of-Bounds Write, Use of Uninitialized Resource and Use-After-Free vulnerabilities exist in the SLDDRW and SLDPRT file reading procedure in eDrawings from Release SOLIDWORKS 2023 through Release SOLIDWORKS 2024Out-Of-Bounds Write, Use of Uninitialized Resource and Use-After-Free vulnerabilities exist in the file reading procedure in eDrawings from Release SOLIDWORKS 2023 through Release SOLIDWORKS 2024. These vulnerabilities could allow an attacker to execute arbitrary code while opening a specially crafted SLDDRW or SLDPRT file. NOTE: this vulnerability was SPLIT from CVE-2024-1847.eDrawingsfrom Release SOLIDWORKS 2023 through Release SOLIDWORKS 2024HighLink to Support Knowledge Base (KB)
2024-04-04 CVE-2024-3298Out-Of-Bounds Write and Type Confusion vulnerabilities exist in the DWG and DXF file reading procedure in eDrawings from Release SOLIDWORKS 2023 through Release SOLIDWORKS 2024Out-Of-Bounds Write and Type Confusion vulnerabilities exist in the file reading procedure in eDrawings from Release SOLIDWORKS 2023 through Release SOLIDWORKS 2024. These vulnerabilities could allow an attacker to execute arbitrary code while opening a specially crafted DWG or DXF. NOTE: this vulnerability was SPLIT from CVE-2024-1847.eDrawingsfrom Release SOLIDWORKS 2023 through Release SOLIDWORKS 2024HighLink to Support Knowledge Base (KB)
2024-03-222024-09-02CVE-2024-1848Multiple vulnerabilities exist in file reading procedure in SOLIDWORKS Desktop on Release SOLIDWORKS 2024Heap-based Buffer Overflow, Memory Corruption, Out-Of-Bounds Read, Out-Of-Bounds Write, Stack-based Buffer Overflow, Type Confusion, Uninitialized Variable, Use-After-Free vulnerabilities exist in the file reading procedure in SOLIDWORKS Desktop on Release SOLIDWORKS 2024. These vulnerabilities could allow an attacker to execute arbitrary code while opening a specially crafted CATPART, DWG, DXF, IPT, JT, SAT, SLDDRW, SLDPRT, STL, STP, X_B or X_T file.SOLIDWORKS DesktopRelease SOLIDWORKS 2024HighLink to Support Knowledge Base (KB)
2024-03-01 CVE-2024-1624OS Command Injection vulnerability affecting documentation server on certain Releases of 3DEXPERIENCE, SIMULIA Abaqus, SIMULIA Isight and CATIA ComposerAn OS Command Injection vulnerability affecting documentation server on 3DEXPERIENCE from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x, SIMULIA Abaqus from Release 2022 through Release 2024, SIMULIA Isight from Release 2022 through Release 2024 and CATIA Composer from Release R2023 through Release R2024. A specially crafted HTTP request can lead to arbitrary command execution.documentation server

from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x

from SIMULIA Abaqus Release 2022 through SIMULIA Abaqus Release 2024

from SIMULIA Isight Release 2022 through SIMULIA Isight Release 2024

from CATIA Composer Release R2023 through CATIA Composer Release R2024

CriticalLink to Support Knowledge Base (KB)
2024-02-282024-09-02CVE-2024-1847Multiple vulnerabilities exist in file reading procedure in eDrawings from Release SOLIDWORKS 2023 through Release SOLIDWORKS 2024Heap-based Buffer Overflow, Memory Corruption, Out-Of-Bounds Read, Out-Of-Bounds Write, Stack-based Buffer Overflow, Type Confusion, Uninitialized Variable, Use-After-Free vulnerabilities exist in the file reading procedure in eDrawings from Release SOLIDWORKS 2023 through Release SOLIDWORKS 2024. These vulnerabilities could allow an attacker to execute arbitrary code while opening a specially crafted CATPART, IPT, JT, SAT, STL, STP, X_B or X_T file. NOTE: CVE-2024-3298 and CVE-2024-3299 were SPLIT from this ID.eDrawingsfrom Release SOLIDWORKS 2023 through Release SOLIDWORKS 2024HighLink to Support Knowledge Base (KB)
2024-02-01 CVE-2023-6078OS Command Injection vulnerability affecting BIOVIA Materials Studio products from Release BIOVIA 2021 through Release BIOVIA 2023An OS Command Injection vulnerability exists in BIOVIA Materials Studio products from Release BIOVIA 2021 through Release BIOVIA 2023. Upload of a specially crafted perl script can lead to arbitrary command execution.BIOVIA Materials Studio productsfrom Release BIOVIA 2021 through Release BIOVIA 2023HighLink to Support Knowledge Base (KB)
2024-02-012024-02-09CVE-2024-0935Insertion of Sensitive Information into Log File vulnerabilities affecting DELMIA Apriso Release 2019 through Release 2024Insertion of Sensitive Information into Log File vulnerabilities are affecting DELMIA Apriso Release 2019 through Release 2024DELMIA Aprisofrom Release 2019 through Release 2024MediumLink to Support Knowledge Base (KB)
2023-11-21 CVE-2023-5599Stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2023xA stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2023x allows an attacker to execute arbitrary script code.3DSwymerfrom Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2023xMediumLink to Support Knowledge Base (KB)
2023-11-212023-11-29CVE-2023-5598Stored Cross-site Scripting (XSS) vulnerabilities affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2023xStored Cross-site Scripting (XSS) vulnerabilities affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2023x allow an attacker to execute arbitrary script code.3DSwymerfrom Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2023xMediumLink to Support Knowledge Base (KB)
2023-10-092023-10-20CVE-2023-3589Cross-Site Request Forgery (CSRF) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022xA Cross-Site Request Forgery (CSRF) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x could allow with some very specific conditions an attacker to send a specifically crafted query to the server.Teamwork Cloud - Business Edition
Teamwork Cloud - Enterprise Edition
Teamwork Cloud - Business Pro Edition
Teamwork Cloud - Standard Edition
from No Magic Release 2021x through No Magic Release 2022xMediumLink to Support Knowledge Base (KB)
2023-09-13 CVE-2023-3588Stored Cross-site Scripting (XSS) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022xA stored Cross-site Scripting (XSS) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x allows an attacker to execute arbitrary script code.Teamwork Cloud - Business Edition
Teamwork Cloud - Enterprise Edition
Teamwork Cloud - Business Pro Edition
Teamwork Cloud - Standard Edition
from No Magic Release 2021x through No Magic Release 2022xMediumLink to Support Knowledge Base (KB)
2023-08-28 CVE-2023-1997OS Command Injection vulnerability affecting SIMULIA 3DOrchestrate from Release 3DEXPERIENCE R2021x through Release 3DEXPERIENCE R2023xAn OS Command Injection vulnerability exists in SIMULIA 3DOrchestrate from Release 3DEXPERIENCE R2021x through Release 3DEXPERIENCE R2023x. A specially crafted HTTP request can lead to arbitrary command execution.SIMULIA 3DOrchestratefrom Release 3DEXPERIENCE R2021x through Release 3DEXPERIENCE R2023xHighLink to Support Knowledge Base (KB)
2023-07-12 CVE-2023-2762Use-After-Free vulnerability in SLDPRT file reading procedure affecting SOLIDWORKS Desktop from Release SOLIDWORKS 2021 through Release SOLIDWORKS 2023A Use-After-Free vulnerability in SLDPRT file reading procedure exists in SOLIDWORKS Desktop from Release SOLIDWORKS 2021 through Release SOLIDWORKS 2023. This vulnerability could allow an attacker to execute arbitrary code while opening a specially crafted SLDPRT file.SOLIDWORKS Desktopfrom Release SOLIDWORKS 2021 through Release SOLIDWORKS 2023HighLink to Support Knowledge Base (KB)
2023-07-122024-09-02CVE-2023-2763Use-After-Free, Out-of-bounds Write and Heap-based Buffer Overflow vulnerabilities exist in the DWG and DXF file reading procedure in SOLIDWORKS Desktop from Release SOLIDWORKS 2021 through Release SOLIDWORKS 2023Use-After-Free, Out-of-bounds Write and Heap-based Buffer Overflow vulnerabilities exist in the DWG and DXF file reading procedure in SOLIDWORKS Desktop from Release SOLIDWORKS 2021 through Release SOLIDWORKS 2023. These vulnerabilities could allow an attacker to execute arbitrary code while opening a specially crafted DWG or DXF file.SOLIDWORKS Desktopfrom Release SOLIDWORKS 2021 through Release SOLIDWORKS 2023HighLink to Support Knowledge Base (KB)
2023-05-192023-07-12CVE-2023-1996Reflected Cross-site Scripting (XSS) vulnerability affecting Release 3DEXPERIENCE R2018x through Release 3DEXPERIENCE R2023xA reflected Cross-site Scripting (XSS) vulnerability in Release 3DEXPERIENCE R2018x through Release 3DEXPERIENCE R2023x allows an attacker to execute arbitrary script code.3DEXPERIENCEfrom Release 3DEXPERIENCE R2018x through Release 3DEXPERIENCE R2023xMediumLink to Support Knowledge Base (KB)
2023-04-21 CVE-2023-2139Reflected Cross-site Scripting vulnerability affecting DELMIA Apriso Release 2017 through Release 2022A reflected Cross-site Scripting (XSS) Vulnerability in DELMIA Apriso Release 2017 through Release 2022 allows an attacker to execute arbitrary script code.DELMIA Aprisofrom Release 2017 through Release 2022MediumLink to Support Knowledge Base (KB)
2023-04-21 CVE-2023-2140Server-Side Request Forgery vulnerability affecting DELMIA Apriso Release 2017 through Release 2022A Server-Side Request Forgery vulnerability in DELMIA Apriso Release  2017 through Release 2022 could allow an unauthenticated attacker to issue requests to arbitrary hosts on behalf of the server running the DELMIA Apriso application.DELMIA Aprisofrom Release 2017 through Release 2022HighLink to Support Knowledge Base (KB)
2023-04-21 CVE-2023-2141Unsafe .NET object deserialization affecting DELMIA Apriso Release 2017 through Release 2022An unsafe .NET object deserialization in DELMIA Apriso Release 2017 through Release 2022 could lead to post-authentication remote code execution.DELMIA Aprisofrom Release 2017 through Release 2022HighLink to Support Knowledge Base (KB)
2023-03-092023-03-20CVE-2023-1287ENOVIA Live Collaboration V6R2013xE is affected by an XSL template injection vulnerability.An XSL template vulnerability in ENOVIA Live Collaboration V6R2013xE allows Remote Code Execution.ENOVIA Live Collaborationfrom V6R2013xE Golden through V6R2013xE FP.CFA.2228Critical

Link to Support Knowledge Base (KB)

 

2023-03-092023-03-20CVE-2023-1288ENOVIA Live Collaboration V6R2013xE is affected by an XML External Entity injection (XXE) vulnerability.An XML External Entity injection (XXE) vulnerability in ENOVIA Live Collaboration V6R2013xE allows an attacker to read local files on the server.ENOVIA Live Collaborationfrom V6R2013xE Golden through V6R2013xE FP.CFA.2228Medium

Link to Support Knowledge Base (KB)