CVE-2025-0829
Published: 17 March 2025
Description
Adversaries may abuse various implementations of JavaScript for execution.
Security Summary
CVE-2025-0829, published on 2025-03-17, is a stored Cross-site Scripting (XSS) vulnerability (CWE-79) in the 3D Markup component of ENOVIA Collaborative Industry Innovator. It affects releases from 3DEXPERIENCE R2022x through 3DEXPERIENCE R2024x. The flaw allows an attacker to execute arbitrary script code in a user's browser session, with a CVSS v3.1 base score of 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).
The vulnerability can be exploited over the network with low attack complexity by an attacker possessing low privileges. Exploitation requires user interaction, such as a victim viewing the affected 3D Markup content containing the stored malicious payload. Successful exploitation executes arbitrary scripts in the victim's browser session, resulting in high confidentiality and integrity impacts across a changed scope.
Mitigation details are available in the vendor advisory at https://www.3ds.com/vulnerability/advisories.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Stored XSS vulnerability directly enables injection and execution of arbitrary JavaScript code in the victim's browser session upon viewing the malicious 3D Markup content.