PT-2021-22873 · Siemens · Teamcenter

Published 2021-09-14 · Updated 2021-09-28 · CVE-2021-40355

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Teamcenter versions prior to 12.4.0.8 Teamcenter versions prior to 13.0.0.7 Teamcenter versions prior to 13.1.0.5 Teamcenter versions prior to 13.2.0.2

Description The issue is related to an Insecure Direct Object Reference (IDOR) vulnerability. This vulnerability allows an attacker to use user-supplied input to access objects directly.

Recommendations For versions prior to 12.4.0.8, update to version 12.4.0.8 or later. For versions prior to 13.0.0.7, update to version 13.0.0.7 or later. For versions prior to 13.1.0.5, update to version 13.1.0.5 or later. For versions prior to 13.2.0.2, update to version 13.2.0.2 or later.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2021-40355

Affected Products

Teamcenter

References · 3

• https://osv.dev/vulnerability/CVE-2021-40355 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40355 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-987403.pdf · Vendor Advisory