214 lines
10 KiB
JSON
214 lines
10 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.1",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2023-4296",
|
||
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "icscert",
|
||
"dateReserved": "2023-08-10T14:52:35.290Z",
|
||
"datePublished": "2023-08-29T21:42:48.880Z",
|
||
"dateUpdated": "2025-02-13T17:13:13.160Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"affected": [
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "Codebeamer",
|
||
"vendor": "PTC",
|
||
"versions": [
|
||
{
|
||
"lessThanOrEqual": "v22.10-SP7",
|
||
"status": "affected",
|
||
"version": "0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThanOrEqual": "v22.04-SP5",
|
||
"status": "affected",
|
||
"version": "0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThanOrEqual": "v21.09-SP13",
|
||
"status": "affected",
|
||
"version": "0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"status": "unaffected",
|
||
"version": "2.0"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"credits": [
|
||
{
|
||
"lang": "en",
|
||
"type": "finder",
|
||
"user": "00000000-0000-4000-9000-000000000000",
|
||
"value": "Niklas Schilling of SEC Consult Vulnerability Lab reported this vulnerability to CISA."
|
||
}
|
||
],
|
||
"datePublic": "2023-08-29T21:38:00.000Z",
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"supportingMedia": [
|
||
{
|
||
"base64": false,
|
||
"type": "text/html",
|
||
"value": "<span style=\"background-color: rgb(255, 255, 255);\">If an attacker tricks an admin user of PTC Codebeamer into clicking on a malicious link, it may allow the attacker to inject arbitrary code to be executed in the browser on the target device.</span>"
|
||
}
|
||
],
|
||
"value": "If an attacker tricks an admin user of PTC Codebeamer into clicking on a malicious link, it may allow the attacker to inject arbitrary code to be executed in the browser on the target device."
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"attackComplexity": "LOW",
|
||
"attackVector": "NETWORK",
|
||
"availabilityImpact": "HIGH",
|
||
"baseScore": 8.8,
|
||
"baseSeverity": "HIGH",
|
||
"confidentialityImpact": "HIGH",
|
||
"integrityImpact": "HIGH",
|
||
"privilegesRequired": "NONE",
|
||
"scope": "UNCHANGED",
|
||
"userInteraction": "REQUIRED",
|
||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
||
"version": "3.1"
|
||
},
|
||
"format": "CVSS",
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "GENERAL"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"cweId": "CWE-79",
|
||
"description": "CWE-79 Cross-site Scripting",
|
||
"lang": "en",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"providerMetadata": {
|
||
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
|
||
"shortName": "icscert",
|
||
"dateUpdated": "2023-09-18T12:06:22.546Z"
|
||
},
|
||
"references": [
|
||
{
|
||
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-241-01"
|
||
},
|
||
{
|
||
"url": "https://codebeamer.com/cb/wiki/31346480"
|
||
},
|
||
{
|
||
"url": "http://seclists.org/fulldisclosure/2023/Sep/10"
|
||
},
|
||
{
|
||
"url": "http://packetstormsecurity.com/files/174703/PTC-Codebeamer-Cross-Site-Scripting.html"
|
||
}
|
||
],
|
||
"solutions": [
|
||
{
|
||
"lang": "en",
|
||
"supportingMedia": [
|
||
{
|
||
"base64": false,
|
||
"type": "text/html",
|
||
"value": "<p>PTC recommends the following:</p><ul><li>Version 22.10.X: <a target=\"_blank\" rel=\"nofollow\" href=\"https://intland.com/codebeamer-download/\">upgrade to 22.10-SP8</a> or newer version</li><li>Version 22.04.X: <a target=\"_blank\" rel=\"nofollow\" href=\"https://intland.com/codebeamer-download/\">upgrade to 22.04-SP6</a> or newer version</li><li>Version 21.09.X: <a target=\"_blank\" rel=\"nofollow\" href=\"https://intland.com/codebeamer-download/\">upgrade to 21.09-SP14</a> or newer version</li></ul><p>Docker Image download: <a target=\"_blank\" rel=\"nofollow\" href=\"https://hub.docker.com/r/intland/codebeamer/tags\">https://hub.docker.com/r/intland/codebeamer/tags</a></p><p>Codebeamer installers: <a target=\"_blank\" rel=\"nofollow\" href=\"https://intland.com/codebeamer-download/\">https://intland.com/codebeamer-download/</a></p><p>Hosted customers may <a target=\"_blank\" rel=\"nofollow\" href=\"https://codebeamer.com/cb/tracker/1910563?showAll=false\">request an upgrade through the support channel</a>.</p><p>Note that version 2.0 is not impacted by this vulnerability.</p><p>For more information refer to <a target=\"_blank\" rel=\"nofollow\" href=\"https://codebeamer.com/cb/wiki/31346480\">PTC Security Advisory and Resolution</a>.</p>\n\n<br>"
|
||
}
|
||
],
|
||
"value": "PTC recommends the following:\n\n * Version 22.10.X: upgrade to 22.10-SP8 https://intland.com/codebeamer-download/ or newer version\n * Version 22.04.X: upgrade to 22.04-SP6 https://intland.com/codebeamer-download/ or newer version\n * Version 21.09.X: upgrade to 21.09-SP14 https://intland.com/codebeamer-download/ or newer version\n\n\nDocker Image download: https://hub.docker.com/r/intland/codebeamer/tags https://hub.docker.com/r/intland/codebeamer/tags \n\nCodebeamer installers: https://intland.com/codebeamer-download/ https://intland.com/codebeamer-download/ \n\nHosted customers may request an upgrade through the support channel https://codebeamer.com/cb/tracker/1910563 .\n\nNote that version 2.0 is not impacted by this vulnerability.\n\nFor more information refer to PTC Security Advisory and Resolution https://codebeamer.com/cb/wiki/31346480 ."
|
||
}
|
||
],
|
||
"source": {
|
||
"discovery": "EXTERNAL"
|
||
},
|
||
"title": "PTC Codebeamer Cross site scripting",
|
||
"x_generator": {
|
||
"engine": "Vulnogram 0.1.0-dev"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"providerMetadata": {
|
||
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
||
"shortName": "CVE",
|
||
"dateUpdated": "2024-08-02T07:24:04.488Z"
|
||
},
|
||
"title": "CVE Program Container",
|
||
"references": [
|
||
{
|
||
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-241-01",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://codebeamer.com/cb/wiki/31346480",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "http://seclists.org/fulldisclosure/2023/Sep/10",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "http://packetstormsecurity.com/files/174703/PTC-Codebeamer-Cross-Site-Scripting.html",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"timestamp": "2025-01-16T21:20:33.944438Z",
|
||
"id": "CVE-2023-4296",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "total"
|
||
}
|
||
],
|
||
"role": "CISA Coordinator",
|
||
"version": "2.0.3"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2025-01-16T21:30:47.228Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |