CVE-2025-4984: 3DEXPERIENCE City Discover XSS Flaw

CVE-2025-4984 Overview

CVE-2025-4984 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting the City Discover component in City Referential Manager on Release 3DEXPERIENCE R2025x. An authenticated attacker can persist malicious script payloads that execute in the browser session of any user who later renders the affected content. Because the injected payload runs in the victim's authenticated context, the attacker can hijack sessions, exfiltrate sensitive city referential data, or perform unauthorized actions on behalf of the user. The scope is changed, meaning the impact extends beyond the vulnerable component to other trusted security contexts in the 3DEXPERIENCE platform.

Critical Impact
Authenticated attackers can store malicious JavaScript that executes in other users' browsers, enabling session hijacking and unauthorized actions within the 3DEXPERIENCE R2025x environment.

Affected Products

Dassault Systèmes 3DEXPERIENCE R2025x
City Referential Manager (City Discover feature)
Deployments exposing City Discover content to multiple authenticated users

Discovery Timeline

2025-05-30 - CVE-2025-4984 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-4984

Vulnerability Analysis

The flaw is a stored XSS issue in the City Discover capability within City Referential Manager. User-controllable input persisted by the application is rendered back to other users without sufficient output encoding or input sanitization. When a victim loads the affected view, the attacker-supplied JavaScript executes within the origin of the 3DEXPERIENCE web application.

Exploitation requires low-privileged authentication and user interaction to trigger the stored payload. The changed scope reflects that script executing in the 3DEXPERIENCE web origin can reach session cookies, CSRF tokens, and platform APIs accessible to the victim. Confidentiality and integrity impacts are high because the injected script inherits the victim's permissions across the platform's web interfaces.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. City Discover stores attacker-supplied content in a referential field and later embeds that content into HTML responses without contextual escaping. HTML, attribute, and JavaScript contexts are not separately encoded, allowing <script> tags or event handler attributes to survive into the rendered DOM.

Attack Vector

An authenticated user with permission to create or edit City Referential entries submits a payload containing JavaScript. The payload is persisted server-side. When another user, including higher-privileged operators, opens the affected City Discover view, the browser parses the stored markup and executes the embedded script in the application origin. No additional network position is required beyond standard application access.

See the 3DS Security Advisories for vendor-supplied technical details.

Detection Methods for CVE-2025-4984

Indicators of Compromise

City Referential records containing HTML tags such as <script>, <img onerror=>, <svg onload=>, or javascript: URI schemes.
Outbound requests from user browsers to unexpected domains shortly after rendering City Discover views.
Unexpected session token reuse or API calls from end-user sessions following City Discover access.

Detection Strategies

Inspect City Referential database fields for stored markup or encoded script payloads using server-side content audits.
Monitor 3DEXPERIENCE web access logs for POST/PUT requests to City Referential endpoints containing suspicious markup patterns.
Deploy Content Security Policy (CSP) violation reporting to surface inline script execution attempts on City Discover pages.

Monitoring Recommendations

Forward 3DEXPERIENCE application and web server logs to a centralized analytics platform and alert on anomalous referential edits.
Track authenticated user activity patterns for sudden privilege use or data exports after viewing City Discover content.
Review browser-side telemetry for unexpected document.cookie access or cross-origin XHR/fetch requests originating from the 3DEXPERIENCE origin.

How to Mitigate CVE-2025-4984

Immediate Actions Required

Apply the vendor security update referenced in the 3DS Security Advisories for 3DEXPERIENCE R2025x.
Restrict edit permissions on City Referential entries to a minimal set of trusted users until patching completes.
Audit existing City Referential content for persisted markup and remove any unauthorized payloads.

Patch Information

Dassault Systèmes publishes fixed builds and patch guidance through its security advisory portal. Refer to the 3DS Security Advisories for the specific hotfix and upgrade path applicable to R2025x deployments.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources on 3DEXPERIENCE web interfaces.
Temporarily disable or restrict access to City Discover views until the patch is deployed.
Apply web application firewall rules that block common XSS payload patterns submitted to City Referential endpoints.

bash

# Example CSP header to mitigate inline script execution
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; report-uri /csp-report";