PT-2025-11498 · Dsm · Enovia Collaborative Industry Innovator

Published 2025-03-17 · Updated 2025-10-22 · CVE-2025-0832

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions ENOVIA Collaborative Industry Innovator versions R2022x through R2024x

Description A stored Cross-site Scripting (XSS) vulnerability in Project Gantt allows an attacker to execute arbitrary script code in a user's browser session. This issue permits attackers to run arbitrary script code in user browsers.

Recommendations For versions R2022x through R2024x, consider disabling the Project Gantt feature until a patch is available to prevent exploitation of the stored Cross-site Scripting (XSS) vulnerability. Restrict access to the Project Gantt module to minimize the risk of exploitation. Avoid using the affected Project Gantt functionality in the ENOVIA Collaborative Industry Innovator until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-11556

CVE-2025-0832

Affected Products

Enovia Collaborative Industry Innovator

References · 10

• https://osv.dev/vulnerability/CVE-2025-0832 · Vendor Advisory
• https://3ds.com/vulnerability/advisories · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-0832 · Security Note
• https://bdu.fstec.ru/vul/2025-11556 · Security Note
• https://twitter.com/WolfgangSesin/status/1901656463191204058 · Twitter Post
• https://t.me/cvetracker/19279 · Telegram Post
• https://twitter.com/CVEnew/status/1901638453822923162 · Twitter Post
• https://twitter.com/CveFindCom/status/1901634988090548492 · Twitter Post
• https://t.me/cvedetector/20486 · Telegram Post
• https://t.me/cveNotify/139876 · Telegram Post