Snapshot 32397
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Trust Center Start your security review View & download sensitive information Overview Welcome to the Dotmatics Trust Center for Dotmatics ELN & Data Discovery. In this portal, you will find artefacts and information intended to help customers and partners understand these products' security, privacy, quality, and compliance posture. Compliance CCPA CPRA GDPR ISO 9001:2015 ISO/IEC 27001 ISO/IEC 27001 SoA PCI DSS Documents REPORTSNetwork Diagram REPORTSPenetration Test Report - ELN & DD COMPLIANCEISO 9001:2015 COMPLIANCEISO/IEC 27001 COMPLIANCEISO/IEC 27001 SoA LEGALData Privacy Terms ESGAnti-Modern Slavery (UK) Risk Profile Hosting Product Security Integration Security SSO Support Reports Network Diagram Penetration Test Report - ELN & DD Self-Assessments We are working on our security compliance. We can provide completed questionnaires upon request. Data Security Data Backups Data Erasure Encryption-at-rest View more App Security Application Penetration Testing Code Analysis Credential Management View more ESG Anti-Modern Slavery (UK) Whistleblowing Program Legal Data Privacy Terms Subprocessors Data Processing Agreement View more Data Privacy Cookies Data Protection Officer Employee Privacy Training Access Control Infrastructure Status Monitoring Amazon Web Services Endpoint Security Network Security Corporate Security Policies Information Security Policy Continuous Monitoring Knowledge Base (FAQ) Is Dotmatics Platform validated or GxP compliant? View more Trust Center Updates Customer Security Advisory: CVE-2025-55182 and CVE-2025-66478 Vulnerabilities Date: 5 December 2025 Dotmatics is providing this update to inform our customers of our investigation and response to two notable and recently disclosed vulnerabilities in the JavaScript ecosystem: CVE-2025-55182 and CVE-2025-66478. 1. CVE-2025-55182 React Server Components On 3 December 2025 at approximately 4:12 PM ET, we became aware of a publicly disclosed vulnerability affecting certain React server-side packages (CVE-2025-55182). Reference materials are available here: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components https://nvd.nist.gov/vuln/detail/CVE-2025-55182 Immediately upon becoming aware of this disclosure, we initiated an internal review to evaluate whether any products within our application portfolio incorporate the affected React server-side components. This review was completed at approximately 6:21 PM ET on 3 December 2025. Based on that assessment, no products within our portfolio were found to use the React server-side components associated with CVE-2025-55182. 2. CVE-2025-66478 Next.js (downstream impact) At approximately 10:51 PM ET on 3 December 2025, we became aware of CVE-2025-66478 which is a downstream vulnerability impacting Next.js due to its dependency on the components associated with CVE-2025-55182. Reference materials are available here: https://nextjs.org/blog/CVE-2025-66478 https://nvd.nist.gov/vuln/detail/CVE-2025-66478 Immediately upon becoming aware of this disclosure, we initiated an internal review to evaluate whether any products within our application portfolio incorporate the affected Next.js components. During our review, we identified that two products in our application portfolio: Luma and Sigma components, used affected Next.js versions. Remediation Upon identification of these affected components, we immediately initiated our standard vulnerability response procedures, including patch application, internal testing, quality verification, and deployment. All remediation activities were completed by 4 December 2025. Our monitoring to date has not identified any indicators of abnormal, anomalous, or unauthorized activity associated with these vulnerabilities in the context of our products or environments. We note that vulnerabilities of this nature may evolve as additional security research becomes available. Accordingly, we will continue to monitor for updates and will take further action as necessary. 3. Customer Guidance No customer action is required at this time with respect to our products that incorporated the affected Next.js components. If new information becomes available that changes required customer actions or materially impacts risk, we will issue updated communication. For questions or additional information, please contact your account representative. Dotmatics Not Affected By MoveIT Vulnerabilities Vulnerabilities There have been many first hand and media reports regarding a high risk, high impact vulnerability in MOVEit file transfer software leading to compromise and ransomware attacks across multiple industries. A recent update from CISA can be found here: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a Dotmatics has done a review of implemented software across the organisation and can confirm that we do not run this software, and are not impacted by this vulnerability. Welcome to the Dotmatics Trust Center General Welcome to Dotmatics' Trust Center. We are pleased to announce the launch of our customer-facing, self-service home for documents and answers on security, privacy, and compliance matters. We will also use this Trust Center as a place to provide confirmed information to customers when it's critical that you know the origin is authentic. If you need help using this Trust Center, please contact us. Contact support If you think you may have discovered a vulnerability, please send us a note. Report issue