{"id":"CVE-2024-3300","published":"2024-05-30T15:19:10Z","modified":"2024-08-01T20:05:08Z","title":"Pre-authentication Unsafe .NET object deserialization vulnerability affecting DELMIA Apriso Release 2019 through…","vendor":"Dassault Systèmes","product":"DELMIA Apriso","tier":"tail","description":{"text":"An unsafe .NET object deserialization vulnerability in DELMIA Apriso Release 2019 through Release 2024 could lead to pre-authentication remote code execution.","provenance":"source","from":"CVE.org"},"cvss":{"score":9,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.02866,"percentile":0.86729,"provenance":"source"},"cwes":[{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"references":[{"url":"https://www.3ds.com/vulnerability/advisories","tags":[]}],"priority":{"score":28.6,"factors":[{"name":"EPSS percentile","points":17.35},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":6.3}]},"exploitSources":{"nuclei":[{"id":"CVE-2024-3300","name":"Delmia Apriso - Pre-Authentication Unsafe .NET Object Deserialization","severity":"critical","path":"http/cves/2024/CVE-2024-3300.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3300.yaml"}],"provenance":"source"},"vendorSlug":"dassault-systemes","affectedVersions":[{"vendor":"Dassault Systèmes","product":"DELMIA Apriso","versions":[">= Release 2019 Golden, <= Release 2019 SP5",">= Release 2020 Golden, <= Release 2020 SP4",">= Release 2021 Golden, <= Release 2021 SP3",">= Release 2022 Golden, <= Release 2022 SP3",">= Release 2023 Golden, <= Release 2023 SP2",">= Release 2024 Golden, <= Release 2024 SP1"]}],"euvd":{"id":"EUVD-2024-31890","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-class-dassault-syst-mes-delmia-apriso-cwe-502"}}