All CISA Advisories, EN

PTC Codebeamer

View CSAF

1. EXECUTIVE SUMMARY

  • CVSS v4 5.1
  • ATTENTION: Exploitable remotely/low attack complexity
  • Vendor: PTC
  • Equipment: Codebeamer
  • Vulnerability: Cross-site Scripting

2. RISK EVALUATION

Successful exploitation of this vulnerability could allow an attacker to inject malicious code in the application.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following versions of PTC Codebeamer, an application lifecycle management platform, are affected:

  • Codebeamer: version 22.10 SP9 and prior
  • Codebeamer: version 2.0.0.3 and prior
  • Codebeamer: version 2.1.0.0

3.2 Vulnerability Overview

3.2.1 IMPROPER NEUTRALIZATION OF INPUT DURING WEB PAGE GENERATION (‘CROSS-SITE SCRIPTING’) CWE-79

PTC Codebeamer is vulnerable to a cross site scripting vulnerability that could allow an attacker to inject and execute malicious code.

CVE-2024-3951 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.1 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).

A CVSS v4 score has also been calculated for CVE-2024-3951. A base score of 5.1 has been calculated; the CVSS vector string is (CVSS4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L).

3.3 BACKGROUND

  • CRITICAL INFRASTRUCTURE SECTORS: Information Technology, Critical Manufacturing
  • COUNTRIES/AREAS DEPLOYED:

    […]
    Content was cut in order to protect the source.Please visit the source for the rest of the article.

    This article has been indexed from All CISA Advisories

    Read the original article: