CVE-2024-6377

An URL redirection to untrusted site (open redirect) vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to redirect users to an arbitrary website via a crafted URL.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://www.3ds.com/vulnerability/advisories	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:o:3ds:3dexperience:*:*:*:*:*:*:*:*

History

27 Aug 2024, 08:15

Type	Values Removed	Values Added
CWE	~~CWE-79~~
Summary	(en) A reflected Cross-site Scripting (XSS) vulnerability affecting 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.	(en) An URL redirection to untrusted site (open redirect) vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to redirect users to an arbitrary website via a crafted URL.

21 Aug 2024, 15:54

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-08-20 14:15

Updated : 2024-08-27 08:15

NVD link : CVE-2024-6377

Mitre link : CVE-2024-6377

CVE.ORG link : CVE-2024-6377

JSON object : View

Products Affected

3ds

3dexperience

CWE

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

{"id": "CVE-2024-6377", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "3DS.Information-Security@3ds.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "published": "2024-08-20T14:15:09.917", "references": [{"url": "https://www.3ds.com/vulnerability/advisories", "tags": ["Vendor Advisory"], "source": "3DS.Information-Security@3ds.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-601"}]}, {"type": "Secondary", "source": "3DS.Information-Security@3ds.com", "description": [{"lang": "en", "value": "CWE-601"}]}], "descriptions": [{"lang": "en", "value": "An URL redirection to untrusted site (open redirect) vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to redirect users to an arbitrary website via a crafted URL."}, {"lang": "es", "value": "Una vulnerabilidad Cross-site Scripting (XSS) Reflejado que afecta a 3DSwymer desde la versi\u00f3n 3DEXPERIENCE R2022x hasta la versi\u00f3n 3DEXPERIENCE R2024x permite a un atacante ejecutar c\u00f3digo de secuencia de comandos arbitrario en la sesi\u00f3n del navegador del usuario."}], "lastModified": "2024-08-27T08:15:05.537", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:3ds:3dexperience:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B93CFC94-1C87-4D26-81F4-A0761C028123", "versionEndIncluding": "r2024x", "versionStartIncluding": "r2022x"}], "operator": "OR"}]}], "sourceIdentifier": "3DS.Information-Security@3ds.com"}