​If an attacker tricks an admin user of PTC Codebeamer into clicking on a malicious link, it may allow the attacker to inject arbitrary code to be executed in the browser on the target device.

Project Subscriptions

Vendors Products
Intland Subscribe
Codebeamer Subscribe
Advisories
Source ID Title
EUVD EUVD EUVD-2023-54167 ​If an attacker tricks an admin user of PTC Codebeamer into clicking on a malicious link, it may allow the attacker to inject arbitrary code to be executed in the browser on the target device.
Fixes

Solution

PTC recommends the following: * ​Version 22.10.X: upgrade to 22.10-SP8 https://intland.com/codebeamer-download/  or newer version * ​Version 22.04.X: upgrade to 22.04-SP6 https://intland.com/codebeamer-download/  or newer version * ​Version 21.09.X: upgrade to 21.09-SP14 https://intland.com/codebeamer-download/  or newer version ​Docker Image download: https://hub.docker.com/r/intland/codebeamer/tags https://hub.docker.com/r/intland/codebeamer/tags ​Codebeamer installers: https://intland.com/codebeamer-download/ https://intland.com/codebeamer-download/ ​Hosted customers may request an upgrade through the support channel https://codebeamer.com/cb/tracker/1910563 . ​Note that version 2.0 is not impacted by this vulnerability. ​For more information refer to PTC Security Advisory and Resolution https://codebeamer.com/cb/wiki/31346480 .


Workaround

No workaround given by the vendor.

History

Thu, 13 Feb 2025 17:15:00 +0000

Type Values Removed Values Added
Description ​If an attacker tricks an admin user of PTC Codebeamer into clicking on a malicious link, it may allow the attacker to inject arbitrary code to be executed in the browser on the target device. ​If an attacker tricks an admin user of PTC Codebeamer into clicking on a malicious link, it may allow the attacker to inject arbitrary code to be executed in the browser on the target device.

Thu, 16 Jan 2025 22:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: icscert

Published:

Updated: 2025-02-13T17:13:13.160Z

Reserved: 2023-08-10T14:52:35.290Z

Link: CVE-2023-4296

cve-icon Vulnrichment

Updated: 2024-08-02T07:24:04.488Z

cve-icon NVD

Status : Modified

Published: 2023-08-29T22:15:09.297

Modified: 2025-02-13T17:17:17.657

Link: CVE-2023-4296

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses