9.4

CVE-2024-1624

An OS Command Injection vulnerability affecting documentation server on 3DEXPERIENCE from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x, SIMULIA Abaqus from Release 2022 through Release 2024, SIMULIA Isight from Release 2022 through Release 2024 and CATIA Composer from Release R2023 through Release R2024. A specially crafted HTTP request can lead to arbitrary command execution.

Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
Diese Information steht angemeldeten Benutzern zur Verfügung.
Daten sind bereitgestellt durch das CVE Programm von Authorized Data Publishers (ADP) (Unstrukturiert)
Hersteller3ds
≫
Produkt 3dexperience
Default Statusunknown
Version <= r2022.fp.cfa.2406
Version r2022x_golden
Status affected
Version <= R2023x.FP.CFA.2350
Version r2023x_golden
Status affected
Version <= R2024x.FP.CFA.2405
Version r2024x_golden
Status affected
Hersteller3ds
≫
Produkt simulia_abaqus
Default Statusunknown
Version <= 2022.FP.CFA.2406
Version 2022_golden
Status affected
Version <= 2023.FP.CFA.2350
Version 2023_golden
Status affected
Version <= 2024.FP.CFA.2405
Version 2024_golden
Status affected
Hersteller3ds
≫
Produkt simulia_insight
Default Statusunknown
Version 2022_golden
Status affected
Version 2023_golden
Status affected
Version 2024_golden
Status affected
Hersteller3ds
≫
Produkt catia_composer
Default Statusunknown
Version <= R2023_Refresh4
Version r2023_golden
Status affected
Version <= R2023_Refresh3
Version r2024_golden
Status affected
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.36% 0.574
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
3DS.Information-Security@3ds.com 9.4 3.9 5.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.