8.7High
CVE-2025-0600Stored Cross-site Scripting (XSS) vulnerability affecting Product Explorer in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x
Description
A stored Cross-site Scripting (XSS) vulnerability affecting Product Explorer in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
Weakness (CWE):
CWE-79
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| 3ds | 3dexperience enovia | r2024x | |
| Dassault Systèmes | ENOVIA Collaborative Industry Innovator | Release 3DEXPERIENCE R2024x Golden – ≤ Release 3DEXPERIENCE R2024x.FP.CFA.2432 |
References and patches
- https://www.3ds.com/vulnerability/advisories Vendor Advisory
CPE matches (NVD) (1)
cpe:2.3:a:3ds:3dexperience_enovia:r2024x:*:*:*:*:*:*:*