title: Server-Side Request Forgery vulnerability affecting DELMIA Apriso Release 2017 through Release 2022
description: A Server-Side Request Forgery vulnerability in DELMIA Apriso Release  2017 through Release 2022
could allow an unauthenticated attacker to issue requests to arbitrary hosts on behalf of the server running the DELMIA Apriso application.
problem types: CWE-918 Server-Side Request Forgery (SSRF)
affected:
{
vendor: Dassault Systèmes
product: DELMIA Apriso
versions:
status: affected, version: Apriso 2017 Golden, lessThanOrEqual: Apriso 2017 SP7, versionType: custom
status: affected, version: Apriso 2018 Golden, lessThanOrEqual: Apriso 2018 SP4, versionType: custom
status: affected, version: Apriso 2019 Golden, lessThanOrEqual: Apriso 2019 SP5, versionType: custom
status: affected, version: Apriso 2020 Golden, lessThanOrEqual: Apriso 2020 SP4, versionType: custom
status: affected, version: Apriso 2021 Golden, lessThanOrEqual: Apriso 2021 SP2, versionType: custom
status: affected, version: Apriso 2022 Golden
defaultStatus: unaffected
}
metrics:
format: CVSS
scenarios: GENERAL
cvssV3_1: [
version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
]