{"id":"CVE-2024-3301","published":"2024-05-30T15:18:14Z","modified":"2024-09-03T15:31:28Z","title":"Post-authentication Unsafe .NET object deserialization vulnerability affecting DELMIA Apriso Release 2019 through…","vendor":"Dassault Systèmes","product":"DELMIA Apriso","tier":"tail","description":{"text":"An unsafe .NET object deserialization vulnerability in DELMIA Apriso Release 2019 through Release 2024 could lead to post-authentication remote code execution.","provenance":"source","from":"CVE.org"},"cvss":{"score":8.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00671,"percentile":0.51884,"provenance":"source"},"cwes":[{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"references":[{"url":"https://www.3ds.com/vulnerability/advisories","tags":[]}],"priority":{"score":16.3,"factors":[{"name":"EPSS percentile","points":10.38},{"name":"CVSS severity","points":5.95}]},"vendorSlug":"dassault-systemes","affectedVersions":[{"vendor":"Dassault Systèmes","product":"DELMIA Apriso","versions":[">= Release 2019 Golden, <= Release 2019 SP5",">= Release 2020 Golden, <= Release 2020 SP4",">= Release 2021 Golden, <= Release 2021 SP3",">= Release 2022 Golden, <= Release 2022 SP3",">= Release 2023 Golden, <= Release 2023 SP2",">= Release 2024 Golden, <= Release 2024 SP1"]}],"euvd":{"id":"EUVD-2024-31891","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-class-dassault-syst-mes-delmia-apriso-cwe-502"}}