CVE-2025-12956: 3dexperience enovia from r2022x (inclusive), through r2025x (inclusive); +1 more affected products

Affected technology

3dexperience enovia · from r2022x (inclusive), through r2025x (inclusive)
3ds

ENOVIA Collaborative Industry Innovator · Release 3DEXPERIENCE R2022x Golden through Release 3DEXPERIENCE R2022x.FP.CFA.2521, Release 3DEXPERIENCE R2023x Golden through Release 3DEXPERIENCE R2023x.FP.CFA.2523, Release 3DEXPERIENCE R2024x Golden through Release 3DEXPERIENCE R2024x.FP.CFA.2519, Release 3DEXPERIENCE R2025x Golden through Release 3DEXPERIENCE R2024x.FP.CFA.2524
Dassault Systèmes

Description’s affected range: through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · User interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · Low privileges required · User interaction required

What an attacker can do

An attacker can execute arbitrary script code in user's browser session. Vendor/CNA’s CVSS 3.1 assessment (base score 8.7/10) rates confidentiality and integrity impact as high; availability impact as none. NVD’s CVSS 3.1 assessment (base score 5.4/10) rates confidentiality and integrity impact as low; availability impact as none.