PT-2024-18175 · Dsy · Simulia Isight+3

Published 2024-03-01 · Updated 2024-03-02 · CVE-2024-1624

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions 3DEXPERIENCE versions R2022x through R2024x SIMULIA Abaqus versions 2022 through 2024 SIMULIA Isight versions 2022 through 2024 CATIA Composer versions R2023 through R2024

Description The issue is an OS Command Injection vulnerability affecting the documentation server. It can be exploited through a specially crafted HTTP request, leading to arbitrary command execution.

Recommendations For 3DEXPERIENCE versions R2022x through R2024x, consider disabling the documentation server until a patch is available. For SIMULIA Abaqus versions 2022 through 2024, restrict access to the documentation server to minimize the risk of exploitation. For SIMULIA Isight versions 2022 through 2024, avoid using the vulnerable documentation server functionality until the issue is resolved. For CATIA Composer versions R2023 through R2024, as a temporary workaround, consider restricting the use of the documentation server until a fix is provided.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2024-1624

Affected Products

3Dexperience

Catia Composer

Simulia Abaqus

Simulia Isight

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-1624 · Security Note
• https://twitter.com/cracbot/status/1764024194973479239 · Twitter Post
• https://3ds.com/vulnerability/advisories · Note
• https://t.me/cvenotify/72805 · Telegram Post
• https://t.me/cvenotify/72831 · Telegram Post