{"id":49154,"date":"2025-06-05T20:30:18","date_gmt":"2025-06-05T20:30:18","guid":{"rendered":""},"modified":"2025-07-03T23:18:06","modified_gmt":"2025-07-04T05:18:06","slug":"cve-2025-0602-stored-cross-site-scripting-vulnerability-in-collaborative-industry-innovator","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-0602-stored-cross-site-scripting-vulnerability-in-collaborative-industry-innovator\/","title":{"rendered":"CVE-2025-0602: Stored Cross-Site Scripting Vulnerability in Collaborative Industry Innovator<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

The Common Vulnerabilities and Exposures (CVE) system has issued a warning regarding a significant security vulnerability, assigned the identifier CVE-2025-0602. This security flaw affects the Collaborative Industry Innovator, a product under the umbrella of 3DEXPERIENCE, from Release R2023x through Release R2025x. The vulnerability in question is a stored Cross-Site<\/a> Scripting (XSS) flaw, which could potentially enable an attacker to execute arbitrary script code within the browser session of an unsuspecting user. This type of vulnerability is particularly dangerous as it could lead<\/a> to system compromise or data leakage, highlighting the necessity of addressing it promptly and adequately.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-0602
\nSeverity: High (8.7 CVSS Score)
\nAttack Vector: Network
\nPrivileges Required: None
\nUser Interaction: Required
\nImpact: System compromise<\/a> or data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

Collaborative Industry<\/a> Innovator | 3DEXPERIENCE R2023x – 3DEXPERIENCE R2025x<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The exploit takes advantage of a stored XSS vulnerability<\/a> in the Compare feature of Collaborative Industry Innovator. An attacker could inject malicious script code<\/a> into the application’s stored data. When this data is later retrieved and rendered in a browser, the malicious script is executed<\/a>. This scenario assumes that the attacker is able to lure a victim, typically through social engineering, to access the crafted data<\/a>.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

Below is a conceptual example of how the vulnerability might be exploited<\/a>. In this case, a malicious payload is sent via a POST request to a vulnerable<\/a> endpoint.<\/p>\n

POST \/vulnerable\/compare HTTP\/1.1\nHost: target.example.com\nContent-Type: application\/json\n{\n\"compare_data\": \"<script>evil_function();<\/script>\"\n}<\/code><\/pre>\n
In this example, `evil_function()` represents a malicious script that the attacker wishes to execute in the user’s<\/a> browser.
\nGiven the high-severity CVSS score and potential impact, it is recommended that users apply the vendor-supplied patch as soon as possible. In the meantime, a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can be used as a temporary mitigation measure.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview The Common Vulnerabilities and Exposures (CVE) system has issued a warning regarding a significant security vulnerability, assigned the identifier CVE-2025-0602. This security flaw affects the Collaborative Industry Innovator, a product under the umbrella of 3DEXPERIENCE, from Release R2023x through Release R2025x. The vulnerability in question is a stored Cross-Site Scripting (XSS) flaw, which could […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[81],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-49154","post","type-post","status-publish","format-standard","hentry","category-uncategorized","attack_vector-xss"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t