PT-2021-11281 · Jt2Go+1 · Jt2Go+1

Rgod · Published 2021-01-12 · Updated 2021-02-23 · CVE-2020-26981

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: JT2Go versions prior to 13.1.0 Teamcenter Visualization versions prior to 13.1.0

Description: A vulnerability has been identified that could allow remote attackers to disclose arbitrary files when opening a specially crafted xml file. This issue arises from the application passing specially crafted content to the underlying XML parser without proper restrictions, such as prohibiting an external DTD.

Recommendations: For JT2Go versions prior to 13.1.0, update to version 13.1.0 or later to resolve the issue. For Teamcenter Visualization versions prior to 13.1.0, update to version 13.1.0 or later to resolve the issue. As a temporary workaround, consider restricting the processing of external XML entities in the XML parser to minimize the risk of exploitation.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2020-26981

ZDI-21-048

Affected Products

Jt2Go

Teamcenter Visualization

References · 4

• https://zerodayinitiative.com/advisories/ZDI-21-048 · Security Note
• https://osv.dev/vulnerability/CVE-2020-26981 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26981 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-622830.pdf · Vendor Advisory