Stored Cross-site Scripting Vulnerability in Product Manager by Dassault Systèmes
CVE-2025-4989

8.7HIGH

Key Information:

Vendor

Dassault Systèmes

Status
Product Manager
Vendor
CVE Published:
30 May 2025

What is CVE-2025-4989?

A stored Cross-site Scripting (XSS) vulnerability in the Product Manager component of 3DEXPERIENCE from releases R2022x to R2025x allows attackers to inject malicious scripts. These scripts can be executed in the browser sessions of unsuspecting users, leading to unauthorized actions or data exposure. It is crucial for organizations using affected versions to apply necessary patches and review their security policies to prevent exploitation.

Affected Version(s)

Product Manager Release 3DEXPERIENCE R2022x Golden

Product Manager Release 3DEXPERIENCE R2023x Golden

Product Manager Release 3DEXPERIENCE R2024x Golden

References

https://www.3ds.com/vulnerability/advisories

CVSS V3.1

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.