CVE-2023-2141

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An unsafe .NET object deserialization in DELMIA Apriso Release 2017 through Release 2022 could lead to post-authentication remote code execution.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

VendorProductVersions
Dassault SystèmesDELMIA Apriso>= Apriso 2017 Golden, <= Apriso 2017 SP7; >= Apriso 2018 Golden, <= Apriso 2018 SP4; >= Apriso 2019 Golden, <= Apriso 2019 SP5; >= Apriso 2020 Golden, <= Apriso 2020 SP4; >= Apriso 2021 Golden, <= Apriso 2021 SP2; Apriso 2022 Golden

References

Timeline

Published
Apr 21, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-214108.8User provided input is not sanitized on the AXIS License Plate Verifier specific “api.cgi” allowing for arbitrary code execution.CVE-2023-214118.8User provided input is not sanitized in the “Settings > Access Control” configuration interface allowing for arbitrary code execution.CVE-2023-214128.8User provided input is not sanitized on the AXIS License Plate Verifier specific “search.cgi” allowing for SQL injections.CVE-2023-214137.2GoSecure on behalf of Genetec Inc. has found a flaw that allows for a remote code execution during the installation of ACAP applications on CVE-2023-214146.8NCC Group has found a flaw during the annual internal penetration test ordered by Axis Communications. The protection for device tampering (CVE-2023-214158.1Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API overlay_del.cgi is vulnerable to path traversal attacksCVE-2023-214166.5Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi was vulnerable to a Denial-of-ServicCVE-2023-214177.1Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API manageoverlayimage.cgi was vulnerable to path traversaCVE-2023-214187.1Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API irissetup.cgi was vulnerable to path traversal attacks CVE-2023-214197.5An improper implementation logic in Secure Folder prior to SMR Jan-2023 Release 1 allows the Secure Folder container remain unlocked under cCVE-2023-21426.1In Nunjucks versions prior to version 3.2.4, it was possible to bypass the restrictions which are provided by the autoescape functionalityCVE-2023-214207.8Use of Externally-Controlled Format String vulnerabilities in STST TA prior to SMR Jan-2023 Release 1 allows arbitrary code execution.