CVE-2024-3951: Cross-site Scripting in PTC Codebeamer

High severity · published May 8, 2024

CVE-2024-3951

Cross-site Scripting in PTC Codebeamer

7.1

CVSS

0.3%

EPSS

On KEV

Description

PTC Codebeamer is vulnerable to a cross site scripting vulnerability that could allow an attacker to inject and execute malicious code.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

Low

Integrity

Low

Availability

Low

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)0.3% · higher than 28% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Codebeamer · PTC

through 22.10 SP9; through 2.0.0.3; 2.1.0.0 · source: vendor, CISA

Affected product

Codebeamer

PTC

All Codebeamer CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2024-3951

CVE.org

https://www.cve.org/CVERecord?id=CVE-2024-3951

www.cisa.gov

https://www.cisa.gov/news-events/ics-advisories/icsa-24-128-01