Geovia Geospatial Data Manager
Monthly
Authenticated code injection in Dassault Systèmes GEOVIA Geospatial Data Manager allows a low-privilege user with a valid session to execute arbitrary code on the server, and the changed-scope metric means the compromised component can be leveraged to affect other parts of the hosting 3DEXPERIENCE environment. The flaw carries a 9.9 CVSS score (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and affects GEOVIA Geospatial Data Manager deployed on 3DEXPERIENCE R2024x through R2026x up to the listed FP.CFA build levels; no user interaction is required beyond the attacker's own authenticated access. There is no indication of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so the practical exposure is gated by the requirement for a valid low-privilege account and by the product's narrow mining and geospatial deployment footprint.
Authenticated code injection in Dassault Systèmes GEOVIA Geospatial Data Manager allows a low-privilege user with a valid session to execute arbitrary code on the server, and the changed-scope metric means the compromised component can be leveraged to affect other parts of the hosting 3DEXPERIENCE environment. The flaw carries a 9.9 CVSS score (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and affects GEOVIA Geospatial Data Manager deployed on 3DEXPERIENCE R2024x through R2026x up to the listed FP.CFA build levels; no user interaction is required beyond the attacker's own authenticated access. There is no indication of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so the practical exposure is gated by the requirement for a valid low-privilege account and by the product's narrow mining and geospatial deployment footprint.