3Dswymer
Monthly
Account takeover affects the 3DPassport identity component bundled with Dassault Systèmes 3DSwymer across 3DEXPERIENCE releases R2023x through R2026x, where an improper authorization flaw (CWE-285) lets a remote, unauthenticated attacker who lures a victim into interacting with crafted content gain access to some user accounts. Because 3DPassport is the platform's single-sign-on gateway, a successful attack yields high confidentiality and integrity impact and crosses a trust boundary (scope-changed) into downstream 3DEXPERIENCE apps. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied.
Stored cross-site scripting in the 3DSearch feature of Dassault Systèmes 3DSwymer on 3DEXPERIENCE Release R2025x allows an attacker to persist script content that executes in the browser session of a second user who later loads the affected 3DSearch view. The vendor-assigned CVSS 3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), and our independent assessment shifts the privilege requirement to PR:L, reflecting that stored XSS normally demands an account with content-write access even though the vendor vector claims no privileges. Impact stays within the browser's origin/session context - Low confidentiality and integrity with no availability effect - and there is no public exploit code identified at time of analysis, with EPSS at 0.20% (9th percentile).
Stored cross-site scripting in the 3DSwym social-collaboration module of 3DSwymer on Dassault Systèmes 3DEXPERIENCE R2025x allows an attacker to persist crafted script into content that other users subsequently view, executing arbitrary JavaScript inside those victims' browser sessions. The vendor assigns CVSS 3.1 base 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), but our independent assessment revises the privilege prerequisite to PR:L, since planting a durable payload in practice requires at least a low-privileged account with access to a content-submission surface such as posts, comments, or profile fields, and successful execution still depends on a victim opening the affected page (UI:R). Impact is confined to the browser session with no availability effect (C:L/I:L/A:N), EPSS is low at 0.20% (9th percentile), and no public exploit has been identified at time of analysis - there is no CISA KEV listing and no POC referenced; the flaw is scoped strictly to the R2025x release of 3DSwymer.
Account takeover affects the 3DPassport identity component bundled with Dassault Systèmes 3DSwymer across 3DEXPERIENCE releases R2023x through R2026x, where an improper authorization flaw (CWE-285) lets a remote, unauthenticated attacker who lures a victim into interacting with crafted content gain access to some user accounts. Because 3DPassport is the platform's single-sign-on gateway, a successful attack yields high confidentiality and integrity impact and crosses a trust boundary (scope-changed) into downstream 3DEXPERIENCE apps. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied.
Stored cross-site scripting in the 3DSearch feature of Dassault Systèmes 3DSwymer on 3DEXPERIENCE Release R2025x allows an attacker to persist script content that executes in the browser session of a second user who later loads the affected 3DSearch view. The vendor-assigned CVSS 3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), and our independent assessment shifts the privilege requirement to PR:L, reflecting that stored XSS normally demands an account with content-write access even though the vendor vector claims no privileges. Impact stays within the browser's origin/session context - Low confidentiality and integrity with no availability effect - and there is no public exploit code identified at time of analysis, with EPSS at 0.20% (9th percentile).
Stored cross-site scripting in the 3DSwym social-collaboration module of 3DSwymer on Dassault Systèmes 3DEXPERIENCE R2025x allows an attacker to persist crafted script into content that other users subsequently view, executing arbitrary JavaScript inside those victims' browser sessions. The vendor assigns CVSS 3.1 base 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), but our independent assessment revises the privilege prerequisite to PR:L, since planting a durable payload in practice requires at least a low-privileged account with access to a content-submission surface such as posts, comments, or profile fields, and successful execution still depends on a victim opening the affected page (UI:R). Impact is confined to the browser session with no availability effect (C:L/I:L/A:N), EPSS is low at 0.20% (9th percentile), and no public exploit has been identified at time of analysis - there is no CISA KEV listing and no POC referenced; the flaw is scoped strictly to the R2025x release of 3DSwymer.