CVE-2023-1997: OS Command Injection vulnerability affecting SIMULIA 3DOrchestrate from Release 3DEXPERIENCE R2021x through Release 3DEXPERIENCE R2023x

Published Aug 28, 2023

Updated

An OS Command Injection vulnerability exists in SIMULIA 3DOrchestrate from Release 3DEXPERIENCE R2021x through Release 3DEXPERIENCE R2023x. A specially crafted HTTP request can lead to arbitrary command execution.

Affected Software

3 affected components

3DS 3DEXPERIENCE=r2021x

3DS 3DEXPERIENCE=r2022x

3DS 3DEXPERIENCE=r2023x

Event History

Aug 28, 2023

CVE Published

via MITRE·03:37 PM

Data Sourced

via MITRE·03:37 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2023-1997?

CVE-2023-1997 is an OS Command Injection vulnerability in SIMULIA 3DOrchestrate from Release 3DEXPERIENCE R2021x through Release 3DEXPERIENCE R2023x.

How severe is CVE-2023-1997?

CVE-2023-1997 has a severity rating of 8.8 (high).

How do I exploit the CVE-2023-1997 vulnerability?

To exploit CVE-2023-1997, an attacker would need to send a specially crafted HTTP request that can lead to arbitrary command execution.

Which software versions are affected by CVE-2023-1997?

The following versions of SIMULIA 3DOrchestrate are affected: Release 3DEXPERIENCE R2021x, R2022x, and R2023x.

How can I fix CVE-2023-1997?

To fix CVE-2023-1997, it is recommended to apply the latest security patches provided by the vendor.