5.1
Medium
CVE-2024-54005 A vulnerability has been identified in COMOS V10.3 (All versions < V10.3.3.5.8), COMOS V10.4.0 (All versions), COMOS…
Description
A vulnerability has been identified in COMOS V10.3 (All versions < V10.3.3.5.8), COMOS V10.4.0 (All versions), COMOS V10.4.1 (All versions), COMOS V10.4.2 (All versions), COMOS V10.4.3 (All versions < V10.4.3.0.47), COMOS V10.4.4 (All versions < V10.4.4.2), COMOS V10.4.4.1 (All versions < V10.4.4.1.21). The PDMS/E3D Engineering Interface improperly handles XML External Entity (XXE) entries when communicating with an external application. This could allow an attacker to extract any file with a known location on the user's system or accessible network folders by injecting malicious data into the communication channel between the two systems.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| COMOS V10.3 10.3 | earliest → < 10.3.3.5.8 | 10.3.3.5.8 |
| COMOS V10.4.0 | Versions not published | |
| COMOS V10.4.1 | Versions not published | |
| COMOS V10.4.2 | Versions not published | |
| COMOS V10.4.3 10.4 | earliest → < 10.4.3.0.47 | 10.4.3.0.47 |
| COMOS V10.4.4 10.4 | earliest → < 10.4.4.2 | 10.4.4.2 |
| COMOS V10.4.4.1 10.4 | earliest → < 10.4.4.1.21 | 10.4.4.1.21 |
Other CVEs of COMOS V10.3
The 7 CVEs of COMOS V10.3 →
CVE-2024-49704
A vulnerability has been identified in COMOS V10.3 (All versions < V10.3.3.5.8), COMOS V10.4.0 (All versions), COMOS…
5.5
Medium
CVE-2021-37194
A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All…
Not rated
CVE-2021-37198
A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All…
8.8
High
CVE-2021-37197
A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All…
Not rated