Overview
A significant cybersecurity threat has been detected in Project Portfolio Manager, a key component of the 3DEXPERIENCE platform. It is identified as CVE-2025-4985 and is a stored Cross-site Scripting (XSS) vulnerability. This vulnerability affects the Risk Management module from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x. Given the widespread use of the 3DEXPERIENCE suite in various industries, this vulnerability could potentially impact hundreds of businesses, leading to system compromise or data leakage. Hence, it is critical to understand and address this vulnerability promptly.
Vulnerability Summary
CVE ID: CVE-2025-4985
Severity: High (8.7 CVSS score)
Attack Vector: Web-based (XSS)
Privileges Required: User
User Interaction: Required
Impact: System Compromise and Data Leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
3DEXPERIENCE Project Portfolio Manager | R2022x – R2025x
How the Exploit Works
The XSS vulnerability within the Project Portfolio Manager allows an attacker to inject malicious script, which is then stored on the server. When a user accesses a compromised page, the malicious script is served and executed within the user’s browser session. This execution can lead to unauthorized system access or data leakage. The attacker can use this vulnerability to potentially gain control over the user’s session, hijack user accounts, perform actions on behalf of the user, and even extract sensitive data.
Conceptual Example Code
Here’s a conceptual example of how this vulnerability can be exploited. Note that this is a simplified example intended for illustrative purposes:
POST /vulnerable/endpoint HTTP/1.1
Host: target.example.com
Content-Type: application/json
{ "input_field": "<script>malicious code here</script>" }In this example, the malicious code is inserted into an input field and sent to the server in a POST request. When the server stores this input and subsequently serves it to users, the malicious script is executed in the user’s browser, leading to a successful exploit of the vulnerability.
Mitigation and Prevention
The most effective way to mitigate this vulnerability is to apply the vendor patch. In cases where immediate patching is not possible, a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can be used as a temporary mitigation measure. These systems can be configured to detect and block attempts to exploit this vulnerability. Furthermore, it is recommended to follow best practices for XSS prevention, such as input validation, output encoding, and using secure HTTP headers.