{"id":"CVE-2023-2140","aliases":["EUVD-2023-33659","GHSA-xc69-c397-p3r8"],"status":"published","title":"Server-Side Request Forgery vulnerability affecting DELMIA Apriso Release 2017 through Release 2022","description":"A Server-Side Request Forgery vulnerability in DELMIA Apriso Release  2017 through Release 2022 \n\ncould allow an unauthenticated attacker to issue requests to arbitrary hosts on behalf of the server running the DELMIA Apriso application.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00563,"percentile":0.47137,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-918"],"published":"2023-04-21T15:48:25Z","modified":"2026-06-17T05:51:35Z","products":[{"vendor":"3ds","product":"delmia_apriso"},{"vendor":"dassault systèmes","product":"delmia apriso"}],"references":[{"url":"https://www.3ds.com/vulnerability/advisories","tags":["x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-2140"},{"url":"https://github.com/advisories/GHSA-xc69-c397-p3r8"}],"sources":{"cve":[{"id":"CVE-2023-2140","title":"Server-Side Request Forgery vulnerability affecting DELMIA Apriso Release 2017 through Release 2022 ","description":"A Server-Side Request Forgery vulnerability in DELMIA Apriso Release  2017 through Release 2022 \n\ncould allow an unauthenticated attacker to issue requests to arbitrary hosts on behalf of the server running the DELMIA Apriso application.\n","status":"published","published":"2023-04-21T15:48:25.654Z","modified":"2025-02-04T20:27:09.654Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:35:24.004321Z"}],"euvd":[{"id":"EUVD-2023-33659","description":"A Server-Side Request Forgery vulnerability in DELMIA Apriso Release  2017 through Release 2022 \n\ncould allow an unauthenticated attacker to issue requests to arbitrary hosts on behalf of the server running the DELMIA Apriso application.\n","status":"published","published":"2023-04-21T15:48:25Z","modified":"2025-02-04T20:27:09Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T00:04:05.9572Z"}],"ghsa":[{"id":"GHSA-xc69-c397-p3r8","title":"A Server-Side Request Forgery vulnerability in DELMIA Apriso Release  2017 through Release 2022 \n...","description":"A Server-Side Request Forgery vulnerability in DELMIA Apriso Release  2017 through Release 2022 \n\ncould allow an unauthenticated attacker to issue requests to arbitrary hosts on behalf of the server running the DELMIA Apriso application.\n","status":"published","published":"2023-04-21T18:30:24Z","modified":"2024-04-04T03:38:10Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:56:16.933961Z"}],"nvd":[{"id":"CVE-2023-2140","description":"A Server-Side Request Forgery vulnerability in DELMIA Apriso Release  2017 through Release 2022 \n\ncould allow an unauthenticated attacker to issue requests to arbitrary hosts on behalf of the server running the DELMIA Apriso application.\n","status":"published","published":"2023-04-21T16:15:07.38Z","modified":"2026-06-17T05:51:35.013Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:07:56.683259Z"}]}}