Stored XSS Vulnerability in ENOVIA Collaborative Industry Innovator
CVE-2024-12091

8.7HIGH

Key Information:

Vendor

Dassault Systèmes

Status
Enovia Collaborative Industry Innovator
Vendor
CVE Published:
16 December 2024

What is CVE-2024-12091?

CVE-2024-12091 identifies a significant stored Cross-Site Scripting (XSS) vulnerability in the ENOVIA Collaborative Industry Innovator software by Dassault Systèmes. This flaw impacts the versions from 3DEXPERIENCE R2022x through R2024x, allowing attackers to inject and execute arbitrary script code within a user's browser session. If exploited, it could potentially enable malicious actors to perform unauthorized actions on behalf of users, compromising sensitive data and leading to security breaches. Promptly updating to the latest version is critical to mitigate this severe risk.

Affected Version(s)

ENOVIA Collaborative Industry Innovator Release 3DEXPERIENCE R2022x Golden

ENOVIA Collaborative Industry Innovator Release 3DEXPERIENCE R2023x Golden

ENOVIA Collaborative Industry Innovator Release 3DEXPERIENCE R2024x Golden

References

https://www.3ds.com/vulnerability/advisories

CVSS V3.1

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2024-12091 : Stored XSS Vulnerability in ENOVIA Collaborative Industry Innovator