Cyber Posture

CVE-2025-0827

High

Published: 17 March 2025

Published
17 March 2025
Modified
15 April 2026
KEV Added
Patch
CVSS Score 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
EPSS Score 0.0034 56.6th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.

Security Summary

CVE-2025-0827 is a stored Cross-site Scripting (XSS) vulnerability, classified under CWE-79, affecting the 3DPlay component in 3DSwymer across 3DEXPERIENCE releases from R2022x through R2024x. It enables an attacker to execute arbitrary script code within a user's browser session. The vulnerability carries a CVSS v3.1 base score of 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), indicating high severity due to its network accessibility, low complexity, and potential for significant confidentiality and integrity impacts with a changed scope.

Exploitation requires an attacker to possess low privileges (PR:L) and involves user interaction (UI:R), such as a victim accessing malicious content over the network. A successful stored XSS attack allows the injected script to execute in the context of other users' browser sessions, potentially leading to high confidentiality and integrity violations, such as session hijacking, data theft, or further compromise within the affected application.

Mitigation details are outlined in the vendor advisory available at https://www.3ds.com/vulnerability/advisories. Security practitioners should consult this resource for patch information, workarounds, or upgrade guidance specific to the impacted 3DEXPERIENCE releases.

Details

CWE(s)
CWE-79

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
T1185 Browser Session Hijacking Collection
Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
Why these techniques?

Stored XSS in network-accessible web app enables public-facing application exploitation (T1190), arbitrary JavaScript execution in browser (T1059.007), and browser session hijacking (T1185) as described.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References