CVE-2024-6377

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

An URL redirection to untrusted site (open redirect) vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to redirect users to an arbitrary website via a crafted URL.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

Vendor	Product	Versions
Dassault Systèmes	3DSwymer	>= Release 3DEXPERIENCE R2022x Golden, <= Release 3DEXPERIENCE R2022x.FP.CFA.2424; >= Release 3DEXPERIENCE R2023x Golden, <= Release 3DEXPERIENCE R2023x.FP.CFA.2419; >= Release 3DEXPERIENCE R2024x Golden, <= Release 3DEXPERIENCE R2024x.FP.CFA.2424
dassault	3dswymer_3dexperience_2022	<= fp.cfa.2424
dassault	3dswymer_3dexperience_2023	<= fp.cfa.2419
dassault	3dswymer_3dexperience_2024	<= fp.cfa.2424

References

https://www.3ds.com/vulnerability/advisoriesVendor Advisory

Timeline

Published: Aug 20, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-63785.4A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x thro CVE-2024-63796.1A reflected Cross-site Scripting (XSS) vulnerability affecting 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x CVE-2024-63805.4A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x thro CVE-2024-63815.3The bson_strfreev function in the MongoDB C driver library may be susceptible to an integer overflow where the function will try to free mem CVE-2024-63827.5Incorrect handling of certain string inputs may result in MongoDB Rust driver constructing unintended server commands. This may cause unexpe CVE-2024-63835.3The bson_string_append function in MongoDB C Driver may be vulnerable to a buffer overflow where the function might attempt to allocate too CVE-2024-63845.3"Hot" backup files may be downloaded by underprivileged users, if they are capable of acquiring a unique backup identifier. This issue affec CVE-2024-63859.8An issue was discovered in GitLab CE/EE affecting all versions starting from 15.8 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and CVE-2024-63868.8The WPML plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.6.12 via Twig Server-Side Templ CVE-2024-63878.1A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle som CVE-2024-63885.5Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks the Pro token to unprivileged users by passin CVE-2024-63894.3An issue was discovered in GitLab-CE/EE affecting all versions starting with 17.0 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2.