PT-2024-37583 · Ds Systemes · Enovia Collaborative Industry Innovator

Published 2024-10-16 · Updated 2025-10-22 · CVE-2024-6380

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions ENOVIA Collaborative Industry Innovator versions 3DEXPERIENCE R2022x through 3DEXPERIENCE R2024x

Description A reflected Cross-site Scripting (XSS) vulnerability allows an attacker to execute arbitrary script code in a user's browser session. This issue affects ENOVIA Collaborative Industry Innovator and can be exploited by attackers to run malicious script code in user browsers.

Recommendations For versions 3DEXPERIENCE R2022x through 3DEXPERIENCE R2024x, consider disabling any features that may be leveraging reflective XSS functionalities until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-6380

Affected Products

Enovia Collaborative Industry Innovator

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-6380 · Security Note
• https://3ds.com/vulnerability/advisories · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-6380 · Vendor Advisory
• https://t.me/cveNotify/139891 · Telegram Post
• https://t.me/cvedetector/8050 · Telegram Post
• https://twitter.com/cracbot/status/1848242933126033627 · Twitter Post
• https://twitter.com/CveFindCom/status/1846521792464101594 · Twitter Post
• https://twitter.com/CVEnew/status/1846516083471372743 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1846593438151483511 · Twitter Post