Summary
A reflected cross site scripting vulnerability in the authentication redirect flow (/auth/) of Teamcenter allows an unauthenticated remote attacker to inject JavaScript into an authenticated user's session by crafting a malicious URL. Successful exploitation may enable the attacker to read data or perform actions within the victim's Teamcenter session.
Siemens has released new versions for the affected products and recommends to update to the latest versions.
Vulnerabilities 1
-
Medium 6.1
A vulnerability has been identified in Teamcenter V2412 (All versions < V2412.0013), Teamcenter V2506 (All versions < V…
Revision history
-
#2
Initial CISA Republication of Siemens ProductCERT SSA-157465 advisory
-
#1
Publication Date
References
-
SSA-157465: Reflected Cross-site scripting Vulnerability in Teamcenter - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-157465.html
-
ICS Advisory ICSA-26-258-07 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-07
-
Recommended Practices
https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b