Overview
The Common Vulnerabilities and Exposures (CVE) system has issued a warning regarding a significant security vulnerability, assigned the identifier CVE-2025-0602. This security flaw affects the Collaborative Industry Innovator, a product under the umbrella of 3DEXPERIENCE, from Release R2023x through Release R2025x. The vulnerability in question is a stored Cross-Site Scripting (XSS) flaw, which could potentially enable an attacker to execute arbitrary script code within the browser session of an unsuspecting user. This type of vulnerability is particularly dangerous as it could lead to system compromise or data leakage, highlighting the necessity of addressing it promptly and adequately.
Vulnerability Summary
CVE ID: CVE-2025-0602
Severity: High (8.7 CVSS Score)
Attack Vector: Network
Privileges Required: None
User Interaction: Required
Impact: System compromise or data leakage
Affected Products
Share secrets securely
Ameeba is private infrastructure for communication and sensitive work built on encrypted identity instead of exposed corporate identity systems.
Passwords, credentials, confidential files, screenshots, internal discussions, sensitive AI context, and private coordination should not become exposed across ordinary communication platforms.
- • Encrypted identity
- • Private Spaces for organizations and teams
- • End-to-end encrypted chat, calls, files, and notes
- • Sensitive AI work and protected collaboration
- • Built for information that cannot leak
Our mission is to secure human work alongside AI.
Product | Affected Versions
Collaborative Industry Innovator | 3DEXPERIENCE R2023x – 3DEXPERIENCE R2025x
How the Exploit Works
The exploit takes advantage of a stored XSS vulnerability in the Compare feature of Collaborative Industry Innovator. An attacker could inject malicious script code into the application’s stored data. When this data is later retrieved and rendered in a browser, the malicious script is executed. This scenario assumes that the attacker is able to lure a victim, typically through social engineering, to access the crafted data.
Conceptual Example Code
Below is a conceptual example of how the vulnerability might be exploited. In this case, a malicious payload is sent via a POST request to a vulnerable endpoint.
POST /vulnerable/compare HTTP/1.1
Host: target.example.com
Content-Type: application/json
{
"compare_data": "<script>evil_function();</script>"
}In this example, `evil_function()` represents a malicious script that the attacker wishes to execute in the user’s browser.
Given the high-severity CVSS score and potential impact, it is recommended that users apply the vendor-supplied patch as soon as possible. In the meantime, a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can be used as a temporary mitigation measure.