Multiple Vulnerabilities in Teamcenter Active Workspace
Monitor6.1SSA-622535Jul 13, 2021
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionRequired
Summary
Multiple vulnerabilities in Teamcenter Active Workspace versions V4 (before 4.3.9), V5.0 (before 5.0.7), and V5.1 (before 5.1.4) allow sensitive information disclosure and reflected cross-site scripting attacks. An attacker can craft a malicious URL that, when visited by a user, reflects injected code back into the browser and steals data or session information. Siemens has released patched versions for all affected product lines.
What this means
What could happen
An attacker could trick a user into clicking a malicious link to steal sensitive information or execute scripts in their browser session, potentially compromising engineering or design data and process credentials.
Who's at risk
Manufacturing and product lifecycle management (PLM) teams using Siemens Teamcenter Active Workspace. This affects any plant or facility that uses Teamcenter for engineering design, document management, or process data storage, particularly where design or operational data must be kept confidential.
How it could be exploited
An attacker crafts a malicious URL containing injected script code and tricks a Teamcenter user into clicking it. When the user visits the link, the unvalidated input is reflected back in the web application and executed in their browser, allowing the attacker to steal session cookies, credentials, or sensitive project data.
Prerequisites
- User must click a malicious link sent by attacker (phishing, social engineering)
- Access to Teamcenter Active Workspace web interface
remotely exploitablelow complexityuser interaction required (phishing)information disclosure riskcross-site scripting capability
Exploitability
Low exploit probability (EPSS 0.5%)
Affected products (3)
3 with fix
ProductAffected VersionsFix Status
Teamcenter Active Workspace V4< V4.3.94.3.9
Teamcenter Active Workspace V5.0< V5.0.75.0.7
Teamcenter Active Workspace V5.1< V5.1.45.1.4
Remediation & Mitigation
0/3
Schedule — requires maintenance window
0/3Patching may require device reboot — plan for process interruption
Teamcenter Active Workspace V4
HOTFIXUpdate Teamcenter Active Workspace V4 to version 4.3.9 or later
Teamcenter Active Workspace V5.0
HOTFIXUpdate Teamcenter Active Workspace V5.0 to version 5.0.7 or later
Teamcenter Active Workspace V5.1
HOTFIXUpdate Teamcenter Active Workspace V5.1 to version 5.1.4 or later
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/64f75144-599d-4c81-8347-33e59aa46c03