CVE-2025-0601 in ENOVIA Collaborative Industry Innovator
Summary
by MITRE • 03/17/2025
A stored Cross-site Scripting (XSS) vulnerability affecting Issue Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2025
This stored cross-site scripting vulnerability exists within the issue management functionality of ENOVIA Collaborative Industry Innovator, a product developed by Dassault Systèmes. The flaw affects versions ranging from 3DEXPERIENCE R2022x through R2024x, representing a significant security gap that could be exploited by malicious actors to compromise user sessions. The vulnerability is classified as a stored XSS attack, meaning that malicious scripts are permanently stored on the server and executed whenever affected users access the compromised content. This type of vulnerability falls under CWE-79 which specifically addresses cross-site scripting flaws in web applications. The attack vector leverages the issue management component where users can create, view, and interact with issue records, making it a critical point of entry for attackers seeking to exploit user browsers.
The technical implementation of this vulnerability allows an attacker to inject malicious JavaScript code into issue records or comments within the ENOVIA platform. When authenticated users view these compromised records, their browsers execute the embedded scripts within the context of their active session. This execution occurs because the application fails to properly sanitize or escape user input before rendering it in web pages. The stored nature of the vulnerability means that the malicious payload persists on the server and affects multiple users over time, rather than requiring each user to be individually targeted. This characteristic significantly amplifies the potential impact and makes the vulnerability particularly dangerous in collaborative environments where multiple users interact with shared issue databases.
The operational impact of this vulnerability extends beyond simple script execution, as it provides attackers with the ability to hijack user sessions, steal sensitive information, and potentially escalate privileges within the application. An attacker could craft malicious payloads to steal session cookies, redirect users to phishing sites, or even modify issue records to propagate further attacks. The attack follows the typical ATT&CK framework pattern for client-side attacks, specifically targeting the T1566.001 technique related to credential access through phishing. In a production environment, this vulnerability could compromise the integrity of issue tracking data, lead to unauthorized access to sensitive project information, and potentially enable attackers to manipulate critical business processes. The vulnerability affects organizations using the 3DEXPERIENCE platform for collaborative engineering and innovation processes, where issue management is a core component of their workflow.
Organizations affected by this vulnerability should immediately implement comprehensive mitigations to protect their users and data. The primary defense mechanism involves implementing strict input validation and output encoding for all user-supplied content within the issue management system. This includes sanitizing all text fields, comments, and metadata associated with issue records before storage and rendering. Organizations should also consider implementing content security policies that restrict script execution and prevent unauthorized code injection. Additionally, the application should enforce proper access controls and audit logging to detect unauthorized modifications to issue records. Regular security updates and patches from Dassault Systèmes should be applied immediately upon availability. The implementation of web application firewalls and intrusion detection systems can provide additional layers of protection, while user education about recognizing suspicious issue entries and maintaining secure browsing practices remains essential for comprehensive defense against such client-side attacks.