CVE-2023-3589: Cross-Site Request Forgery (CSRF) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x

High severity · published Oct 9, 2023

CVE-2023-3589

Cross-Site Request Forgery (CSRF) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x

7.5

CVSS

0.2%

EPSS

On KEV

Description

A Cross-Site Request Forgery (CSRF) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x could allow with some very specific conditions an attacker to send a specifically crafted query to the server.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

High

Privileges

None

User interaction

Required

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.2% · higher than 15% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Teamwork Cloud - Business Edition · Dassault Systèmes

No Magic Release 2021x Golden through No Magic Release 2021x Refresh2; No Magic Release 2022x Golden through No Magic Release 2022x Refresh2 · source: vendor

Teamwork Cloud - Business Pro Edition · Dassault Systèmes

No Magic Release 2021x Golden through No Magic Release 2021x Refresh2; No Magic Release 2022x Golden through No Magic Release 2022x Refresh2 · source: vendor

Teamwork Cloud - Enterprise Edition · Dassault Systèmes

No Magic Release 2021x Golden through No Magic Release 2021x Refresh2; No Magic Release 2022x Golden through No Magic Release 2022x Refresh2 · source: vendor

Teamwork Cloud - Standard Edition · Dassault Systèmes

No Magic Release 2021x Golden through No Magic Release 2021x Refresh2; No Magic Release 2022x Golden through No Magic Release 2022x Refresh2 · source: vendor

Teamwork Cloud NO Magic Release · 3ds

2021x; 2022x; 2021x; 2022x; 2021x; 2022x; +2 more · source: NVD

Teamwork Cloud Business Edition · Dassult

no_magic_release_2021x_golden through no_magic_release_2021X_refresh2; no_magic_release_2022x_golden through no_magic_release_2022x_refresh2 · source: CISA

Teamwork Cloud Business Pro Edition · Dassult

no_magic_release_2021x_golden through no_magic_release_2021x_refresh2; no_magic_release_2022x_golden through no_magic_release2022x_refresh2 · source: CISA

Teamwork Cloud Enterprise Edition · Dassault

no_magic_release_2021x_golden through no_magic_release_2021_refresh2; no_magic_release_2022x_golden through no_magic_release_2022_refresh2 · source: CISA

Teamwork Cloud Standard Edition · Dassault

no_magic_release_2021x_golden through no_magic_release_2021x_refresh2; no_magic_release_2022x_golden through no_magic_release_2022x_refresh2 · source: CISA

Affected product

Teamwork Cloud - Business Edition

Dassault Systèmes

All Teamwork Cloud - Business Edition CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2023-3589

CVE.org

https://www.cve.org/CVERecord?id=CVE-2023-3589

Issue Tracking

https://www.3ds.com/vulnerability/advisories

More from Teamwork Cloud - Business Edition

9.8

CVE-2026-7858

Deserialization of Untrusted Data vulnerability affecting Teamwork Cloud from No Magic Release 2022x through No Magic Release 2026x and Magic Collaboration Studio from CATIA Magic Release 2022x through CATIA Magic Release 2026x

5.4

CVE-2023-3588

Stored Cross-site Scripting (XSS) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x