Lucene search

3DSCVE-2023-3589

HistoryOct 09, 2023 - 9:15 a.m.

CVE-2023-3589

2023-10-0909:15:10

CWE-352

3DS

web.nvd.nist.gov

cve-2023-3589

cross-site request forgery

csrf

teamwork cloud

no magic release

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

24.1%

JSON

A Cross-Site Request Forgery (CSRF) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x could allow with some very specific conditions an attacker to send a specifically crafted query to the server.

Affected configurations

Nvd

Node

3dsteamwork_cloud_no_magic_releaseMatch2021xbusiness

3dsteamwork_cloud_no_magic_releaseMatch2022xbusiness

Node

3dsteamwork_cloud_no_magic_releaseMatch2021xenterprise

3dsteamwork_cloud_no_magic_releaseMatch2022xenterprise

Node

3dsteamwork_cloud_no_magic_releaseMatch2021xbusiness_pro

3dsteamwork_cloud_no_magic_releaseMatch2022xbusiness_pro

Node

3dsteamwork_cloud_no_magic_releaseMatch2021xstandard

3dsteamwork_cloud_no_magic_releaseMatch2022xstandard

VendorProductVersionCPE
3dsteamwork_cloud_no_magic_release2021xcpe:2.3:a:3ds:teamwork_cloud_no_magic_release:2021x:*:*:*:business:*:*:*
3dsteamwork_cloud_no_magic_release2022xcpe:2.3:a:3ds:teamwork_cloud_no_magic_release:2022x:*:*:*:business:*:*:*
3dsteamwork_cloud_no_magic_release2021xcpe:2.3:a:3ds:teamwork_cloud_no_magic_release:2021x:*:*:*:enterprise:*:*:*
3dsteamwork_cloud_no_magic_release2022xcpe:2.3:a:3ds:teamwork_cloud_no_magic_release:2022x:*:*:*:enterprise:*:*:*
3dsteamwork_cloud_no_magic_release2021xcpe:2.3:a:3ds:teamwork_cloud_no_magic_release:2021x:*:*:*:business_pro:*:*:*
3dsteamwork_cloud_no_magic_release2022xcpe:2.3:a:3ds:teamwork_cloud_no_magic_release:2022x:*:*:*:business_pro:*:*:*
3dsteamwork_cloud_no_magic_release2021xcpe:2.3:a:3ds:teamwork_cloud_no_magic_release:2021x:*:*:*:standard:*:*:*
3dsteamwork_cloud_no_magic_release2022xcpe:2.3:a:3ds:teamwork_cloud_no_magic_release:2022x:*:*:*:standard:*:*:*

Vendor	Product	Version	CPE
3ds	teamwork_cloud_no_magic_release	2021x	cpe:2.3:a:3ds:teamwork_cloud_no_magic_release:2021x::::business:::
3ds	teamwork_cloud_no_magic_release	2022x	cpe:2.3:a:3ds:teamwork_cloud_no_magic_release:2022x::::business:::
3ds	teamwork_cloud_no_magic_release	2021x	cpe:2.3:a:3ds:teamwork_cloud_no_magic_release:2021x::::enterprise:::
3ds	teamwork_cloud_no_magic_release	2022x	cpe:2.3:a:3ds:teamwork_cloud_no_magic_release:2022x::::enterprise:::
3ds	teamwork_cloud_no_magic_release	2021x	cpe:2.3:a:3ds:teamwork_cloud_no_magic_release:2021x::::business_pro:::
3ds	teamwork_cloud_no_magic_release	2022x	cpe:2.3:a:3ds:teamwork_cloud_no_magic_release:2022x::::business_pro:::
3ds	teamwork_cloud_no_magic_release	2021x	cpe:2.3:a:3ds:teamwork_cloud_no_magic_release:2021x::::standard:::
3ds	teamwork_cloud_no_magic_release	2022x	cpe:2.3:a:3ds:teamwork_cloud_no_magic_release:2022x::::standard:::

CNA Affected

[
  {
    "vendor": "Dassault Systèmes",
    "product": "Teamwork Cloud - Business Edition",
    "versions": [
      {
        "status": "affected",
        "version": "No Magic Release 2021x Golden",
        "lessThanOrEqual": "No Magic Release 2021x Refresh2",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "No Magic Release 2022x Golden",
        "lessThanOrEqual": "No Magic Release 2022x Refresh2",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "Dassault Systèmes",
    "product": "Teamwork Cloud - Enterprise Edition",
    "versions": [
      {
        "status": "affected",
        "version": "No Magic Release 2021x Golden",
        "lessThanOrEqual": "No Magic Release 2021x Refresh2",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "No Magic Release 2022x Golden",
        "lessThanOrEqual": "No Magic Release 2022x Refresh2",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "Dassault Systèmes",
    "product": "Teamwork Cloud - Business Pro Edition",
    "versions": [
      {
        "status": "affected",
        "version": "No Magic Release 2021x Golden",
        "lessThanOrEqual": "No Magic Release 2021x Refresh2",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "No Magic Release 2022x Golden",
        "lessThanOrEqual": "No Magic Release 2022x Refresh2",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "Dassault Systèmes",
    "product": "Teamwork Cloud - Standard Edition",
    "versions": [
      {
        "status": "affected",
        "version": "No Magic Release 2021x Golden",
        "lessThanOrEqual": "No Magic Release 2021x Refresh2",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "No Magic Release 2022x Golden",
        "lessThanOrEqual": "No Magic Release 2022x Refresh2",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

www.3ds.com/vulnerability/advisories

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

24.1%

JSON

Related for CVE-2023-3589