Cyber Posture

CVE-2025-0598

High

Published: 17 March 2025

Published
17 March 2025
Modified
22 October 2025
KEV Added
Patch
CVSS Score 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
EPSS Score 0.0035 57.6th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.

Security Summary

CVE-2025-0598 is a stored Cross-site Scripting (XSS) vulnerability, mapped to CWE-79, affecting the Relations component in ENOVIA Collaborative Industry Innovator from 3DEXPERIENCE R2023x through R2024x releases. Published on 2025-03-17, it carries a CVSS v3.1 base score of 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) and enables an attacker to execute arbitrary script code in a user's browser session.

The vulnerability can be exploited over the network with low attack complexity by an authenticated attacker possessing low privileges (PR:L). Exploitation requires user interaction (UI:R), such as a victim viewing the malicious Relations content, after which the stored payload executes in the victim's browser. The changed scope (S:C) results in high impacts to confidentiality and integrity, allowing potential theft of sensitive data, session manipulation, or unauthorized actions within the affected browser context.

Vendor guidance on mitigation is provided in the advisory at https://www.3ds.com/vulnerability/advisories.

Details

CWE(s)
CWE-79

Affected Products

3ds
3dexperience enovia
r2023x, r2024x

MITRE ATT&CK Enterprise Techniques

T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
T1185 Browser Session Hijacking Collection
Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
T1539 Steal Web Session Cookie Credential Access
An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.
Why these techniques?

Stored XSS directly enables arbitrary JavaScript execution in the victim's browser session (T1059.007), which facilitates browser session hijacking (T1185) and stealing web session cookies (T1539) via script-based theft or manipulation.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References