Browser script execution via unencoded error message
Published Apr 21, 2023 · Updated Feb 4, 2025
Reflected XSS in Dassault Systèmes DELMIA Apriso 2017 through 2022 allows remote attackers to run script in a victim's browser. The logon error renderer inserts the Message query parameter into the page without HTML encoding; an authenticated Portal path does likewise. Exploitation requires a victim to open a crafted link, and the script runs in that victim's Apriso browser context.
Summary
What happened
Reflected XSS in Dassault Systèmes DELMIA Apriso 2017 through 2022 allows remote attackers to run script in a victim's browser. The logon error renderer inserts the Message query parameter into the page without HTML encoding; an authenticated Portal path does likewise. Exploitation requires a victim to open a crafted link, and the script runs in that victim's Apriso browser context.
The record
- CVE
- CVE-2023-2139
- Published
- Apr 21, 2023
- Updated
- Feb 4, 2025
- Vendor
- Dassault Systèmes
- Product
- DELMIA Apriso
- Classifications
- CWE-79, CAPEC-591, T1566.002
- Attack vector
- network
- Privileges
- unauthenticated
Timeline
How it unfolded
- Apr 21, 2023CVE publishedPublication date reported by the CVE source.
- Feb 4, 2025Record updatedLatest update available in the CVE record.
Exploitability
Present is not the same as exploitable
Compare your product and version with the public record. A matching version still requires validation against your environment.
Is a vulnerable build present?
Compare these published version ranges with your installed build and any vendor patches.
- Affected versionversion=Apriso 2017 Golden <=Apriso 2017 SP7
- Affected versionversion=Apriso 2018 Golden <=Apriso 2018 SP4
- Affected versionversion=Apriso 2019 Golden <=Apriso 2019 SP5
- Affected versionversion=Apriso 2020 Golden <=Apriso 2020 SP4
- Affected versionversion=Apriso 2021 Golden <=Apriso 2021 SP1
- Affected versionversion=Apriso 2022 Golden
What conditions does exploitation require?
What is affected?
Published CVSS scores
CVSS describes severity. EPSS estimates exploitation probability.
Attacks
What attackers are doing with it
Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.
Weakness, pattern, technique
Public exploit references
- Synacktiv reflected XSS proof of conceptproof of concept · demonstrated
Labels summarize the accepted research assessment. They do not indicate a test against your environment.
Technologies
Your stack
See the directory against your own environment.
Your stack
Check the software in your environment
Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.
Book a demo