Enovia Collaborative Industry Innovator CVE-2025-10551

Real-world risk is elevated due to multiple converging factors. The CVSS 8.7 score reflects high confidentiality and integrity impact (C:H/I:H) with changed scope, though it requires low-privilege authentication (PR:L) and user interaction (UI:R). The network attack vector (AV:N) and low complexity (AC:L) make remote exploitation feasible once initial access is obtained. In enterprise PLM deployments, stored XSS in document management is particularly dangerous because documents are routinely shared across organizational boundaries, turning a single injection point into a persistent threat vector affecting multiple high-privilege users who interact with the content. The lack of availability impact (A:N) is mitigated by the integrity and confidentiality risks in environments handling sensitive engineering data, intellectual property, and manufacturing specifications. Without EPSS data or confirmed KEV status, prioritization should weight the attack surface exposure: organizations with internet-facing ENOVIA instances or extensive external collaboration face higher risk than air-gapped environments. The requirement for user interaction provides some natural mitigation, but in collaborative workflows where document review is routine, this threshold is easily met. No public exploit identified at time of analysis, but the straightforward nature of stored XSS and vendor disclosure suggests proof-of-concept development is feasible for motivated attackers targeting PLM infrastructure.

An attacker with low-privilege authenticated access to ENOVIA Collaborative Industry Innovator uploads or edits a product specification document in the Document Management module, embedding malicious JavaScript within document metadata fields, description attributes, or rich-text content areas that lack proper input validation. When a product manager or engineering lead with elevated privileges accesses the document to review technical specifications-a routine workflow in PLM environments-the stored script executes in their browser session with their security context. The payload harvests session cookies and authentication tokens, exfiltrating them to attacker-controlled infrastructure, then silently redirects the victim to a legitimate-looking page to avoid suspicion. With stolen high-privilege credentials, the attacker gains persistent access to sensitive engineering data, manufacturing processes, and intellectual property across the 3DEXPERIENCE ecosystem. The changed scope (S:C) means the compromise extends beyond the document management component to other integrated modules sharing the authentication boundary.