XSS in 3ds 3dexperience Enovia
CVE-2024-8004
A stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.003 (23.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.7 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N.
Affected products
- 3ds 3dexperience_enovia — versions r2022x, r2023x, r2024x
- Dassault Systèmes Enovia Collaborative Industry Innovator — versions Release 3DEXPERIENCE R2022x Golden, Release 3DEXPERIENCE R2023x Golden, Release 3DEXPERIENCE R2024x Golden
Weakness classification (CWE)
Public proof-of-concept exploits
References
- 3DS.Information-Security@3ds.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2024-8004?
- CVE-2024-8004 is a high-severity vulnerability in 3ds 3dexperience Enovia, classified under Cross-site Scripting. CVSS score: 8.7/10. Published 2024-09-02.
- How severe is CVE-2024-8004?
- High severity. CVSS v3 base score is 8.7 out of 10.
- Is CVE-2024-8004 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.