Critical severity · published Mar 1, 2024
CVE-2024-1624
OS Command Injection vulnerability affecting documentation server on certain Releases of 3DEXPERIENCE, SIMULIA Abaqus, SIMULIA Isight and CATIA Composer
9.4
CVSS
2.1%
EPSS
No
On KEV
Description
An OS Command Injection vulnerability affecting documentation server on 3DEXPERIENCE from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x, SIMULIA Abaqus from Release 2022 through Release 2024, SIMULIA Isight from Release 2022 through Release 2024 and CATIA Composer from Release R2023 through Release R2024. A specially crafted HTTP request can lead to arbitrary command execution.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DS
Documentation server · Dassault Systèmes
Release 3DEXPERIENCE R2022x Golden through Release 3DEXPERIENCE R2022x.FP.CFA.2406; Release 3DEXPERIENCE R2023x Golden through Release 3DEXPERIENCE R2023x FP.CFA.2350; Release 3DEXPERIENCE R2024x Golden through Release 3DEXPERIENCE R2024x.FP.CFA.2405; SIMULIA Abaqus Release 2022 Golden through SIMULIA Abaqus Release 2022.FP.CFA.2406; SIMULIA Abaqus Release 2023 Golden through SIMULIA Abaqus Release 2023.FP.CFA.2350; SIMULIA Abaqus Release 2024 Golden through SIMULIA Abaqus Release 2024.FP.CFA.2405; +5 more · source: vendor
3D
3dexperience · 3ds
r2022x_golden through r2022.fp.cfa.2406; r2023x_golden through R2023x.FP.CFA.2350; r2024x_golden through R2024x.FP.CFA.2405 · source: CISA
CC
Catia Composer · 3ds
r2023_golden through R2023_Refresh4; r2024_golden through R2023_Refresh3 · source: CISA
SA
Simulia Abaqus · 3ds
2022_golden through 2022.FP.CFA.2406; 2023_golden through 2023.FP.CFA.2350; 2024_golden through 2024.FP.CFA.2405 · source: CISA
SI
Simulia Insight · 3ds
2022_golden; 2023_golden; 2024_golden · source: CISA