CVE-2025-4984 is a high-severity stored Cross-site Scripting (XSS) vulnerability identified in the City Discover component of Dassault Systèmes' City Referential Manager, specifically affecting Release 3DEXPERIENCE R2025x Golden. This vulnerability arises due to improper neutralization of input during web page generation (CWE-79), allowing an attacker to inject malicious script code that is persistently stored and subsequently executed in the browsers of users interacting with the affected application. The vulnerability is exploitable remotely over the network (AV:N) with low attack complexity (AC:L), requiring the attacker to have some level of privileges (PR:L) and user interaction (UI:R). The scope is changed (S:C), meaning the vulnerability affects resources beyond the initially vulnerable component, and it impacts confidentiality and integrity at a high level (C:H/I:H), though availability is not affected (A:N). The vulnerability enables attackers to execute arbitrary JavaScript in the context of the victim's browser session, potentially leading to session hijacking, unauthorized actions on behalf of the user, theft of sensitive data, or the spread of malware. Given that City Referential Manager is part of the 3DEXPERIENCE platform, which is widely used for urban planning, infrastructure management, and smart city applications, exploitation could have significant consequences in environments relying on accurate and secure city data management. The lack of known exploits in the wild suggests that active exploitation has not yet been observed, but the high CVSS score indicates a serious risk if weaponized. No official patches have been linked yet, indicating that organizations must be vigilant and consider interim mitigations. The vulnerability requires authenticated access with user interaction, which somewhat limits the attack surface but does not eliminate risk, especially in environments with many users or where social engineering could be employed. The persistent nature of the XSS means that once malicious code is injected, it can affect multiple users over time until remediated.

For European organizations, especially those involved in urban planning, smart city initiatives, or infrastructure management using Dassault Systèmes' City Referential Manager, this vulnerability poses a significant risk. Exploitation could lead to unauthorized access to sensitive city data, manipulation of urban planning information, or disruption of workflows critical to municipal operations. Confidentiality breaches could expose personal or strategic data, while integrity compromises could result in corrupted or falsified city data, potentially affecting decision-making and public safety. The high integrity impact is particularly concerning for critical infrastructure management. Additionally, the vulnerability could be leveraged to conduct further attacks within the organization's network by stealing session tokens or credentials. Given the interconnected nature of European smart city projects and the emphasis on digital transformation, the threat could have cascading effects beyond a single organization, potentially impacting citizens and public services. The requirement for user interaction and authenticated access somewhat reduces the likelihood of widespread automated exploitation but does not eliminate targeted attacks, especially against high-value targets.

1. Immediate implementation of strict input validation and output encoding on all user-supplied data within the City Referential Manager, focusing on the City Discover component, to prevent injection of malicious scripts. 2. Employ Content Security Policy (CSP) headers to restrict the execution of untrusted scripts in the browser context. 3. Enforce least privilege principles by reviewing and limiting user permissions to reduce the risk posed by authenticated attackers. 4. Conduct thorough user training and awareness programs to mitigate social engineering risks that could lead to exploitation requiring user interaction. 5. Monitor application logs and user activity for unusual behavior indicative of XSS exploitation attempts. 6. Engage with Dassault Systèmes for timely patch deployment once available; in the interim, consider isolating or restricting access to vulnerable components. 7. Utilize Web Application Firewalls (WAFs) configured to detect and block XSS payloads targeting the affected application. 8. Regularly audit and update all dependencies and components within the 3DEXPERIENCE platform to ensure no additional vulnerabilities are present.