CVE-2024-7938: Stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024x

Medium severity · published Sep 2, 2024

CVE-2024-7938

Stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024x

5.4

CVSS

0.3%

EPSS

On KEV

Description

A stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

Required

Confidentiality

Low

Integrity

Low

Availability

None

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)0.3% · higher than 24% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

3DSwymer · Dassault Systèmes

Release 3DEXPERIENCE R2023x Golden through Release 3DEXPERIENCE R2023x.FP.CFA.2410; Release 3DEXPERIENCE R2024x Golden through Release 3DEXPERIENCE R2024x.FP.CFA.2405 · source: vendor

3dexperience · 3ds

r2023x; r2024x · source: NVD

3dswymer 3dexperience 2023 · Dassault

R2023x Golden through R2023x.FP.CFA.2410 · source: CISA

3dswymer 3dexperience 2024 · Dassault

0R2024x Golden through R2024x.FP.CFA.2405 · source: CISA

Affected product

3DSwymer

Dassault Systèmes

All 3DSwymer CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2024-7938

CVE.org

https://www.cve.org/CVERecord?id=CVE-2024-7938

Vendor Advisory

https://www.3ds.com/vulnerability/advisories