CVE-2024-10204 - Vulnerability Details - OpenCVE

Heap-based Buffer Overflow and Uninitialized Variable vulnerabilities exist in the X_B and SAT file reading procedure in eDrawings from Release SOLIDWORKS 2024 through Release SOLIDWORKS 2025. These vulnerabilities could allow an attacker to execute arbitrary code while opening a specially crafted X_B or SAT file.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Dassault	Edrawings

No data.

No data.

References

Link	Providers
https://www.3ds.com/vulnerability/advisories

History

Tue, 19 Nov 2024 14:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Dassault Dassault edrawings
CPEs		cpe:2.3:a:dassault:edrawings::::::::
Vendors & Products		Dassault Dassault edrawings
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 19 Nov 2024 13:30:00 +0000

Type	Values Removed	Values Added
Description		Heap-based Buffer Overflow and Uninitialized Variable vulnerabilities exist in the X_B and SAT file reading procedure in eDrawings from Release SOLIDWORKS 2024 through Release SOLIDWORKS 2025. These vulnerabilities could allow an attacker to execute arbitrary code while opening a specially crafted X_B or SAT file.
Title		Heap-based Buffer Overflow and Uninitialized Variable vulnerabilities exist in eDrawings from Release SOLIDWORKS 2024 through Release SOLIDWORKS 2025
Weaknesses		CWE-122 CWE-457
References		https://www.3ds.com/vulnerability/advisories
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: 3DS

Published: 2024-11-19T13:15:41.223Z

Updated: 2024-11-19T14:09:14.475Z

Reserved: 2024-10-21T07:28:40.214Z

Link: CVE-2024-10204

Vulnrichment

Updated: 2024-11-19T14:09:09.950Z

NVD

Status : Awaiting Analysis

Published: 2024-11-19T14:15:16.940

Modified: 2024-11-19T21:57:32.967

Link: CVE-2024-10204

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-10204", "assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433", "state": "PUBLISHED", "assignerShortName": "3DS", "dateReserved": "2024-10-21T07:28:40.214Z", "datePublished": "2024-11-19T13:15:41.223Z", "dateUpdated": "2024-11-19T14:09:14.475Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433", "shortName": "3DS", "dateUpdated": "2024-11-19T13:15:41.223Z"}, "title": "Heap-based Buffer Overflow and Uninitialized Variable vulnerabilities exist in eDrawings from Release SOLIDWORKS 2024 through Release SOLIDWORKS 2025", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-122", "description": "CWE-122 Heap-based Buffer Overflow", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-457", "description": "CWE-457: Use of Uninitialized Variable", "type": "CWE"}]}], "affected": [{"vendor": "Dassault Syst\u00e8mes", "product": "eDrawings", "versions": [{"status": "affected", "version": "Release SOLIDWORKS 2024 SP0", "lessThanOrEqual": "Release SOLIDWORKS 2024 SP5", "versionType": "custom"}, {"status": "affected", "version": "Release SOLIDWORKS 2025 SP0"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Heap-based Buffer Overflow and Uninitialized Variable vulnerabilities exist in the X_B and SAT file reading procedure in eDrawings from Release SOLIDWORKS 2024 through Release SOLIDWORKS 2025. These vulnerabilities could allow an attacker to execute arbitrary code while opening a specially crafted X_B or SAT file.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Heap-based Buffer Overflow and Uninitialized Variable vulnerabilities exist in the X_B and SAT file reading procedure in eDrawings from Release SOLIDWORKS 2024 through Release SOLIDWORKS 2025. These vulnerabilities could allow an attacker to execute arbitrary code while opening a specially crafted X_B or SAT file."}]}], "references": [{"url": "https://www.3ds.com/vulnerability/advisories"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}}], "credits": [{"lang": "en", "value": "Mat Powell of Trend Micro Zero Day Initiative", "user": "00000000-0000-4000-9000-000000000000", "type": "finder"}, {"lang": "en", "value": "Andrea Micalizzi aka rgod (@rgod777) working with Trend Micro Zero Day Initiative", "user": "00000000-0000-4000-9000-000000000000", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"affected": [{"vendor": "dassault", "product": "edrawings", "cpes": ["cpe:2.3:a:dassault:edrawings:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "solidworks_2024_sp0", "status": "affected", "lessThanOrEqual": "solidworks_2024_sp5", "versionType": "custom"}, {"version": "solidworks_2025_sp0", "status": "affected"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-19T14:04:48.309764Z", "id": "CVE-2024-10204", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-19T14:09:14.475Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-10204", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-11-19T14:04:48.309764Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:dassault:edrawings:*:*:*:*:*:*:*:*"], "vendor": "dassault", "product": "edrawings", "versions": [{"status": "affected", "version": "solidworks_2024_sp0", "versionType": "custom", "lessThanOrEqual": "solidworks_2024_sp5"}, {"status": "affected", "version": "solidworks_2025_sp0"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-19T14:09:09.950Z"}}], "cna": {"title": "Heap-based Buffer Overflow and Uninitialized Variable vulnerabilities exist in eDrawings from Release SOLIDWORKS 2024 through Release SOLIDWORKS 2025", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Mat Powell of Trend Micro Zero Day Initiative"}, {"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Andrea Micalizzi aka rgod (@rgod777) working with Trend Micro Zero Day Initiative"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Dassault Syst\u00e8mes", "product": "eDrawings", "versions": [{"status": "affected", "version": "Release SOLIDWORKS 2024 SP0", "versionType": "custom", "lessThanOrEqual": "Release SOLIDWORKS 2024 SP5"}, {"status": "affected", "version": "Release SOLIDWORKS 2025 SP0"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.3ds.com/vulnerability/advisories"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Heap-based Buffer Overflow and Uninitialized Variable vulnerabilities exist in the X_B and SAT file reading procedure in eDrawings from Release SOLIDWORKS 2024 through Release SOLIDWORKS 2025. These vulnerabilities could allow an attacker to execute arbitrary code while opening a specially crafted X_B or SAT file.", "supportingMedia": [{"type": "text/html", "value": "Heap-based Buffer Overflow and Uninitialized Variable vulnerabilities exist in the X_B and SAT file reading procedure in eDrawings from Release SOLIDWORKS 2024 through Release SOLIDWORKS 2025. These vulnerabilities could allow an attacker to execute arbitrary code while opening a specially crafted X_B or SAT file.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122 Heap-based Buffer Overflow"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-457", "description": "CWE-457: Use of Uninitialized Variable"}]}], "providerMetadata": {"orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433", "shortName": "3DS", "dateUpdated": "2024-11-19T13:15:41.223Z"}}}, "cveMetadata": {"cveId": "CVE-2024-10204", "state": "PUBLISHED", "dateUpdated": "2024-11-19T14:09:14.475Z", "dateReserved": "2024-10-21T07:28:40.214Z", "assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433", "datePublished": "2024-11-19T13:15:41.223Z", "assignerShortName": "3DS"}, "dataVersion": "5.1"}