PT-2025-23300 · Unknown · 3Dexperience

Published 2025-05-30 · Updated 2025-05-30 · CVE-2025-4986

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions 3DEXPERIENCE versions R2022x through R2025x

Description A stored Cross-site Scripting (XSS) vulnerability affects Model Definition in Product Manager, allowing an attacker to execute arbitrary script code in a user's browser session. This issue enables attackers to run malicious code in the user's browser.

Recommendations For versions R2022x through R2025x, consider disabling the Model Definition feature in Product Manager until a patch is available to prevent exploitation of the stored XSS vulnerability. Restrict access to the Product Manager module to minimize the risk of exploitation. Avoid using the Product Manager for sensitive operations until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-11569

CVE-2025-4986

Affected Products

3Dexperience

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-4986 · Security Note
• https://bdu.fstec.ru/vul/2025-11569 · Security Note
• https://3ds.com/vulnerability/advisories · Note
• https://t.me/cvetracker/25020 · Telegram Post
• https://twitter.com/CveFindCom/status/1928461665172943060 · Twitter Post
• https://twitter.com/CVEnew/status/1928466835579474155 · Twitter Post