Overview
We are addressing a serious security vulnerability, classified as CVE-2025-4984, that affects the City Discover in City Referential Manager on 3DEXPERIENCE R2025x. This vulnerability, a type of stored Cross-Site Scripting (XSS), could potentially allow an attacker to execute arbitrary script code within a user’s browser session. As cybersecurity professionals, it’s crucial for us to understand the severity of this situation due to the high potential for system compromise or data leakage. The risk is especially pertinent for those organizations utilizing the affected software in managing and referencing city data.
Vulnerability Summary
CVE ID: CVE-2025-4984
Severity: High (8.7 CVSS Score)
Attack Vector: Network
Privileges Required: Low
User Interaction: Required
Impact: Potential system compromise or data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
City Discover in City Referential Manager | 3DEXPERIENCE R2025x
How the Exploit Works
This Stored Cross-Site Scripting (XSS) vulnerability works when an attacker manages to inject malicious script into a webpage viewed by other users. The script is ‘stored’ on the target server, hence the term ‘stored XSS. When the victim navigates to the affected webpage, the malicious script is executed. In the case of CVE-2025-4984, the attacker would specifically target the City Discover in City Referential Manager software. Upon successful execution, the script runs within the user’s browser session, potentially leading to system compromise or data leakage.
Conceptual Example Code
Consider the following conceptual example illustrating how the vulnerability might be exploited:
POST /city-discover/referential-manager HTTP/1.1
Host: target.example.com
Content-Type: application/json
{ "city_data": "<script> malicious_payload </script>" }In this example, the attacker sends a POST request to the City Discover Referential Manager endpoint with JavaScript embedded within the ‘city_data’ payload. When a user subsequently accesses data from this endpoint, the malicious script is executed in the user’s browser session.
Mitigating this vulnerability should be a priority for any organization using the affected software. Applying the vendor’s patch is the recommended solution, but in the interim, a web application firewall (WAF) or intrusion detection system (IDS) can be used for temporary mitigation.