CVE-2023-4296: PTC Codebeamer Cross site scripting

Published Aug 29, 2023

Updated

?If an attacker tricks an admin user of PTC Codebeamer into clicking on a malicious link, it may allow the attacker to inject arbitrary code to be executed in the browser on the target device.

Other sources

If an attacker tricks an admin user of PTC Codebeamer into clicking on a malicious link, it may allow the attacker to inject arbitrary code to be executed in the browser on the target device.

— MITRE

Affected Software

32 affected components

PTC Codebeamer: v22.10-SP7 or lower

PTC Codebeamer: v22.04-SP5 or lower

PTC Codebeamer: v21.09-SP13 or lower

Intland codeBeamer=21.09.0

Intland codeBeamer=21.09.0-sp1

Intland codeBeamer=21.09.0-sp10

Intland codeBeamer=21.09.0-sp11

Intland codeBeamer=21.09.0-sp12

Intland codeBeamer=21.09.0-sp13

Intland codeBeamer=21.09.0-sp2

Intland codeBeamer=21.09.0-sp3

Intland codeBeamer=21.09.0-sp4

Intland codeBeamer=21.09.0-sp5

Intland codeBeamer=21.09.0-sp6

Intland codeBeamer=21.09.0-sp7

Intland codeBeamer=21.09.0-sp8

Intland codeBeamer=21.09.0-sp9

Intland codeBeamer=22.04.0

Intland codeBeamer=22.04.0-sp1

Intland codeBeamer=22.04.0-sp2

Intland codeBeamer=22.04.0-sp3

Intland codeBeamer=22.04.0-sp4

Intland codeBeamer=22.04.0-sp5

Intland codeBeamer=22.10.0

Intland codeBeamer=22.10.0-sp1

Intland codeBeamer=22.10.0-sp2

Intland codeBeamer=22.10.0-sp3

Intland codeBeamer=22.10.0-sp4

Intland codeBeamer=22.10.0-sp5

Intland codeBeamer=22.10.0-sp6

Intland codeBeamer=22.10.0-sp7

Intland codeBeamer=22.10.0-sp8

Remediation

Information

PTC recommends the following: * Version 22.10.X: upgrade to 22.10-SP8 https://intland.com/codebeamer-download/ or newer version * Version 22.04.X: upgrade to 22.04-SP6 https://intland.com/codebeamer-download/ or newer version * Version 21.09.X: upgrade to 21.09-SP14 https://intland.com/codebeamer-download/ or newer version Docker Image download: https://hub.docker.com/r/intland/codebeamer/tags https://hub.docker.com/r/intland/codebeamer/tags Codebeamer installers: https://intland.com/codebeamer-download/ https://intland.com/codebeamer-download/ Hosted customers may request an upgrade through the support channel https://codebeamer.com/cb/tracker/1910563 . Note that version 2.0 is not impacted by this vulnerability. For more information refer to PTC Security Advisory and Resolution https://codebeamer.com/cb/wiki/31346480 .

Event History

Aug 29, 2023

CVE Published

via MITRE·09:42 PM

Data Sourced

via MITRE·09:42 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:15 PM

DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

ICSA-23-241-01

Frequently Asked Questions

What is the severity of CVE-2023-4296?

CVE-2023-4296 has a high severity rating due to its potential for arbitrary code execution in the target browser.

How do I fix CVE-2023-4296?

To fix CVE-2023-4296, upgrade to PTC Codebeamer versions higher than 22.10-SP7, 22.04-SP5, or 21.09-SP13.

What is the impact of CVE-2023-4296?

CVE-2023-4296 can allow attackers to inject and execute arbitrary code in the browser of an admin user.

Who is affected by CVE-2023-4296?

CVE-2023-4296 affects admin users of PTC Codebeamer versions 22.10-SP7 or lower, 22.04-SP5 or lower, and 21.09-SP13 or lower.

What are the symptoms of exploitation of CVE-2023-4296?

Exploitation of CVE-2023-4296 may not have immediate visible symptoms but can lead to unauthorized commands being executed in the browser.