High severity · published Apr 21, 2023
CVE-2023-2140
A Server-Side Request Forgery vulnerability in DELMIA Apriso Release 2017 through Release 2022 could allow an unauthenticated attacker to issue requests to arbitrary hosts on…
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
A Server-Side Request Forgery vulnerability in DELMIA Apriso Release 2017 through Release 2022
could allow an unauthenticated attacker to issue requests to arbitrary hosts on behalf of the server running the DELMIA Apriso application.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DA
Delmia Apriso · 3ds
2017 through 2022 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-2140
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-2140
Vendor Advisory
https://www.3ds.com/vulnerability/advisories
More from Delmia Apriso
9.1
CVE-2025-6205
Missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025
9.0
CVE-2025-5086
Deserialization of Untrusted Data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025
8.0
CVE-2025-6204
Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025
8.8
CVE-2023-2141
An unsafe .NET object deserialization in DELMIA Apriso Release 2017 through Release 2022 could lead to post-authentication remote code execution
7.5
CVE-2024-0935
Insertion of Sensitive Information into Log File vulnerabilities are affecting DELMIA Apriso Release 2019 through Release 2024