ENOVIA Specification Manager CVE-2025-10556

Exploitation requires an authenticated account (PR:L) with write access to the Specification Management feature of ENOVIA Specification Manager, used to persist a malicious script into a specification data field. Successful script execution additionally requires a second authenticated user to view the affected specification (UI:R), so the payload does not fire automatically. Exploitation is limited to deployments running 3DEXPERIENCE releases R2023x through R2025x; environments on other releases or with restricted specification-edit permissions are not affected. The requirements for both valid credentials and victim interaction meaningfully constrain real-world exploitability beyond what the network attack vector alone suggests.

This is a moderate, not high-priority, issue. The CVSS 3.1 base score is 5.4 (Medium) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - meaning network-reachable but requiring an authenticated account (PR:L), victim interaction (UI:R), and yielding only Low confidentiality and integrity impact with no availability impact. The scope change (S:C) is the main reason the score is not lower, reflecting that injected script executes in another user's browser context. All exploitation signals point AWAY from urgency: EPSS is 0.20% (9th percentile), indicating very low predicted exploitation probability; there is no CISA KEV listing and no public exploit code identified. No SSVC decision data was provided in the input. The signals are internally consistent - a low-EPSS, no-KEV, no-POC, authenticated, user-interaction-dependent stored XSS in enterprise PLM software is a genuine but low-real-world-risk finding that should be patched on a normal maintenance cycle rather than treated as an emergency. No conflicting signals were found in the provided data.

An authenticated user with permission to edit specifications in ENOVIA Specification Manager stores a malicious script payload in a specification field. When another authenticated user (e.g., an engineer or reviewer) opens that specification, the script executes in their browser session, enabling session actions such as data theft or UI manipulation within the application. No public proof-of-concept exploit was identified at the time of analysis.