CVE-2025-0600
Published: 17 March 2025
Summary
CVE-2025-0600 is a high-severity Cross-site Scripting (CWE-79) vulnerability in 3Ds 3Dexperience Enovia. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Session Hijacking (T1185); ranked in the top 42.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Information input validation directly prevents the storage of malicious XSS payloads by checking and sanitizing user inputs in the Product Explorer component.
Information output filtering encodes or sanitizes rendered content to block execution of stored XSS scripts in victims' browser sessions.
Flaw remediation ensures timely patching of the specific stored XSS vulnerability in ENOVIA on 3DEXPERIENCE R2024x per the vendor advisory.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS allows arbitrary client-side script execution in victim's browser to steal session data (T1539) and hijack sessions via cookie theft or content manipulation (T1185).
NVD Description
A stored Cross-site Scripting (XSS) vulnerability affecting Product Explorer in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
Deeper analysisAI
CVE-2025-0600 is a stored Cross-site Scripting (XSS) vulnerability, classified under CWE-79, affecting the Product Explorer component in ENOVIA Collaborative Industry Innovator on the 3DEXPERIENCE R2024x release. Published on 2025-03-17, it has a CVSS v3.1 base score of 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N). The flaw enables an attacker to store malicious script code that executes in a victim's browser session when they interact with affected content.
An authenticated attacker with low privileges (PR:L) can exploit this over the network (AV:N) with low complexity (AC:L), though it requires user interaction (UI:R), such as a victim viewing the stored payload in Product Explorer. Successful exploitation changes scope (S:C) to high confidentiality (C:H) and integrity (I:H) impacts with no availability disruption (A:N), allowing arbitrary script execution in the victim's browser to steal session data, manipulate page content, or perform other client-side attacks.
For mitigation details, refer to the vendor advisory at https://www.3ds.com/vulnerability/advisories.
Details
- CWE(s)