CVE-2025-10557: 3dexperience enovia from r2023x (inclusive), through r2025x (inclusive); +1 more affected products

Affected technology

3dexperience enovia · from r2023x (inclusive), through r2025x (inclusive)
3ds

ENOVIA Collaborative Industry Innovator · Release 3DEXPERIENCE R2022x Golden through Release 3DEXPERIENCE R2022x.FP.CFA.2513, Release 3DEXPERIENCE R2023x Golden through Release 3DEXPERIENCE R2023x.FP.CFA.2514, Release 3DEXPERIENCE R2024x Golden through Release 3DEXPERIENCE R2024x.FP.CFA.2510, Release 3DEXPERIENCE R2025x Golden through Release 3DEXPERIENCE R2024x.FP.CFA.2514
Dassault Systèmes

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · User interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · Low privileges required · User interaction required

What an attacker can do

An attacker can execute arbitrary script code in user's browser session. Vendor/CNA’s CVSS 3.1 assessment (base score 8.7/10) rates confidentiality and integrity impact as high; availability impact as none. NVD’s CVSS 3.1 assessment (base score 5.4/10) rates confidentiality and integrity impact as low; availability impact as none.