CVE-2023-2140 Server-Side Request Forgery vulnerability affecting DELMIA Apriso Release 2017 through Release 2022
Unauthenticated attackers can exploit SSRF in DELMIA Apriso to issue arbitrary requests from the server, potentially accessing internal resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-2140?
CVE-2023-2140 is a high-severity server-side request forgery vulnerability in Dassault Systèmes DELMIA Apriso, published on 21 Apr 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A Server-Side Request Forgery vulnerability in DELMIA Apriso Release 2017 through Release 2022
could allow an unauthenticated attacker to issue requests to arbitrary hosts on behalf of the server running the DELMIA Apriso application.
Weakness: CWE-918
Which versions are affected by CVE-2023-2140?
It affects 1 product.
Products include 3ds Delmia Apriso.
How do I fix CVE-2023-2140?
No fix has been published for CVE-2023-2140 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2023-2140 being exploited?
There is no known exploitation of CVE-2023-2140 in the wild and no public exploit code.
Other vulnerabilities in Dassault Systèmes DELMIA Apriso
- CVE-2025-6205 Dassault Systèmes DELMIA Apriso Missing Authorization
- CVE-2025-5086 Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data
- CVE-2025-6204 Dassault Systèmes DELMIA Apriso Code Injection
- CVE-2023-2141 Unsafe .NET object deserialization affecting DELMIA Apriso Release 2017 through Release 2022
- CVE-2023-2139 Reflected Cross-site Scripting vulnerability affecting DELMIA Apriso Release 2017 through Release 2022
Sources
Also known as GHSA-xc69-c397-p3r8.