Stored XSS in 3DDashboard of 3DSwymer

Successful exploitation allows execution of arbitrary script in the victim user's browser session in the security context of the affected application. This can enable session hijacking, theft of session tokens or other accessible data, execution of unauthorized actions on behalf of the victim, manipulation of displayed content, and potential pivoting to further application abuse depending on the victim's privileges.

Until patches can be applied, reduce exposure by restricting who can create or modify content rendered in 3DDashboard, reviewing and removing untrusted stored content, and monitoring for suspicious script-bearing payloads in dashboard content. Where possible, enforce strong output encoding and content sanitization in customizations, and deploy browser-side controls such as a restrictive Content Security Policy to reduce XSS exploitability. These measures are compensating controls and do not replace vendor remediation.

Apply the vendor-provided fix for CVE-2025-0595 by upgrading 3DSwymer / 3DEXPERIENCE from affected releases R2022x through R2024x to a remediated version provided by the vendor. If exact fixed build information is required, consult the official Dassault Systèmes security advisory or product update documentation for this CVE.