« Volver al listado

CVE-2026-2101

Estado: AplazadaAlta (8.7)—

A Reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIAvpm Web Access from ENOVIAvpm Version 1 Release 16 through ENOVIAvpm Version 1 Release 19 allows an attacker to execute arbitrary script code in user's browser session.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

XSS reflejado (CWE-79) en ENOVIAvpm permite ejecutar scripts arbitrarios en el navegador del usuario. Vector CVSS con UI:R y AV:N confirma T1189 (drive-by). El impacto es ejecución de código JavaScript (T1059.007).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Restrict Web-Based ContentUser TrainingExecution PreventionBehavior Prevention on EndpointDisable or Remove Feature or ProgramApplication Isolation and Sandboxing

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Enoviavpm — EnoviavpmAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-2101",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-2101",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-17T14:52:59.081348Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "3DS.Information-Security@3ds.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.7,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.8,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "3DS.Information-Security@3ds.com",
      "affectedData": [
        {
          "vendor": "Dassault Systèmes",
          "product": "ENOVIAvpm Web Access",
          "versions": [
            {
              "status": "affected",
              "version": "ENOVIAvpm V1R16 Golden",
              "versionType": "custom",
              "lessThanOrEqual": "ENOVIAvpm V1R16 SP6"
            },
            {
              "status": "affected",
              "version": "ENOVIAvpm V1R17 Golden",
              "versionType": "custom",
              "lessThanOrEqual": "ENOVIAvpm V1R17 SP5"
            },
            {
              "status": "affected",
              "version": "ENOVIAvpm V1R18 Golden",
              "versionType": "custom",
              "lessThanOrEqual": "ENOVIAvpm V1R18 SP3"
            },
            {
              "status": "affected",
              "version": "ENOVIAvpm V1R19 Golden",
              "versionType": "custom",
              "lessThanOrEqual": "ENOVIAvpm V1R19 SP1"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-02-16T17:18:09.003",
  "references": [
    {
      "url": "https://www.3ds.com/trust-center/security/security-advisories/cve-2026-2101",
      "source": "3DS.Information-Security@3ds.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "3DS.Information-Security@3ds.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIAvpm Web Access from ENOVIAvpm Version 1 Release 16 through ENOVIAvpm Version 1 Release 19 allows an attacker to execute arbitrary script code in user's browser session."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de cross-site scripting (XSS) reflejado que afecta a ENOVIAvpm Web Access desde ENOVIAvpm Versión 1 Release 16 hasta ENOVIAvpm Versión 1 Release 19 permite a un atacante ejecutar código de script arbitrario en la sesión del navegador del usuario."
    }
  ],
  "lastModified": "2026-06-17T10:30:19.107",
  "sourceIdentifier": "3DS.Information-Security@3ds.com"
}