PT-2025-11497 · Ds Systemes · Enovia Change Manager

Published 2025-03-17 · Updated 2025-10-22 · CVE-2025-0830

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions ENOVIA Change Manager versions 3DEXPERIENCE R2022x through 3DEXPERIENCE R2024x

Description A stored Cross-site Scripting (XSS) vulnerability in Meeting Management allows an attacker to execute arbitrary script code in a user's browser session. This issue affects ENOVIA Change Manager and enables attackers to run script code in user browsers.

Recommendations For versions 3DEXPERIENCE R2022x through 3DEXPERIENCE R2024x, ensure system security updates are in place to mitigate the risk of exploitation. As a temporary workaround, consider restricting access to the Meeting Management feature in ENOVIA Change Manager until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-11558

CVE-2025-0830

Affected Products

Enovia Change Manager

References · 9

• https://3ds.com/vulnerability/advisories · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-0830 · Security Note
• https://bdu.fstec.ru/vul/2025-11558 · Security Note
• https://osv.dev/vulnerability/CVE-2025-0830 · Vendor Advisory
• https://t.me/cvedetector/20485 · Telegram Post
• https://t.me/cvetracker/19278 · Telegram Post
• https://t.me/cveNotify/139875 · Telegram Post
• https://twitter.com/CveFindCom/status/1901635035351925174 · Twitter Post
• https://twitter.com/CVEnew/status/1901638454775075230 · Twitter Post