High severity · published Apr 21, 2023
CVE-2023-2140
Server-Side Request Forgery vulnerability affecting DELMIA Apriso Release 2017 through Release 2022
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
A Server-Side Request Forgery vulnerability in DELMIA Apriso Release 2017 through Release 2022
could allow an unauthenticated attacker to issue requests to arbitrary hosts on behalf of the server running the DELMIA Apriso application.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DA
DELMIA Apriso · Dassault Systèmes
Apriso 2017 Golden through Apriso 2017 SP7; Apriso 2018 Golden through Apriso 2018 SP4; Apriso 2019 Golden through Apriso 2019 SP5; Apriso 2020 Golden through Apriso 2020 SP4; Apriso 2021 Golden through Apriso 2021 SP2; Apriso 2022 Golden · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-2140
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-2140
Vendor Advisory
https://www.3ds.com/vulnerability/advisories
More from DELMIA Apriso
9.1
CVE-2025-6205
Missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025
9.0
CVE-2025-5086
Deserialization of Untrusted Data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025
8.0
CVE-2025-6204
Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025
9.8
CVE-2026-9695
Improper Authentication vulnerability affecting DELMIA Apriso from Release 2020 through Release 2026
9.0
CVE-2024-3300
Pre-authentication Unsafe .NET object deserialization vulnerability affecting DELMIA Apriso Release 2019 through Release 2024