CVE-2024-0935 is a medium severity flaw (CVSS 4.4) in DELMIA Apriso. The record links the vendor advisories page but names no fixed release. This guide covers who is affected, how to check your exposure, and what to do now.
What's affected
DELMIA Apriso Release 2019 through Release 2024.
The record gives a CVSS base score of 4.4 (Medium), vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. The weakness class is CWE-532.
The record says sensitive information can be written to a log file. It scores this 4.4 Medium.
The record links the vendor advisories page but names no fixed release. The advisory page we tried to fetch returned a not found error, so check the vendor security advisories portal directly.
How to check if you're exposed
In the Apriso administration tools, read the installed release. Then review where application logs are stored, who can read them, and whether they contain credentials or tokens.
A free in-browser dependency scan at gold.safeguard.sh/scan can show whether a software package in your own projects matches this CVE, and the Gold directory entry for CVE-2024-0935 keeps the record details in one place. Reachability analysis helps you separate installations where the vulnerable code can actually be hit from those where it sits unused.
For hardware and appliances, no scanner will find them unless they are in an inventory, so start with a list of every device and application of this kind on your network.
What to do now
- Identify every instance of DELMIA Apriso in your environment, including test and forgotten systems.
- Compare the version you found with the affected range above.
- Look for a fixed release from the vendor or project. The record links the vendor advisories page but names no fixed release.
- Apply mitigations while you wait: limit read access to log files, rotate and expire them, and rotate any secret you find in historical logs.
- Review logs around the affected component for unusual requests.
- Record the decision and a re-check date in your vulnerability tracker.
Why it matters
The weakness is CWE-532, sensitive information written into a log file. Log files tend to be copied, shipped to monitoring systems and read by more people than the application itself, so a secret placed in a log can travel far.
The fix is usually to stop writing the data, then clear and rotate what was already stored. Anyone with read access to historical logs should be treated as having seen what is in them.
The record shows this CVE is not in the CISA Known Exploited Vulnerabilities catalog, and none of the pages used for this article report exploitation in the wild.
Quick check
What should I do beyond patching?
Review old logs for secrets and rotate any you find.
Where can I confirm the fixed version?
Check the vendor or project advisory first. The record links the vendor advisories page but names no fixed release. This article is based on the NVD record and the pages listed under Sources.
Sources
Last reviewed: 19 October 2026.
