Cross-site scripting in Siemens Teamcenter

Successful exploitation allows execution of attacker-supplied script in the context of another user's session when that user visits a maliciously crafted or tainted Teamcenter page. Based on the provided CVSS information, the primary impacts are high confidentiality and high integrity impact, with no direct availability impact. In practice, this can enable theft of session data, access to sensitive application content available to the victim, unauthorized actions performed as the victim within Teamcenter, and manipulation of displayed or submitted data.

If immediate patching is not possible, reduce exposure of Teamcenter web interfaces to untrusted users and networks, restrict access to authenticated and least-privileged users, and monitor for suspicious content injection in application pages or stored user-supplied fields. Because exploitation requires another user to load the affected page, limiting who can create or modify rendered content and applying standard web security controls and vendor-recommended defensive measures can reduce risk. The supplied advisory context also recommends standard ICS defensive practices such as minimizing network exposure, isolating control networks, and using secure remote access methods.

Upgrade Siemens Teamcenter to a fixed release. The provided content identifies the fixed-version thresholds as V2312.0014 or later, V2406.0012 or later, V2412.0009 or later, and V2506.0005 or later. For V2512, the content states that all versions are affected; no fixed V2512 build is provided in the supplied material, so customers should follow Siemens ProductCERT advisory SSA-827383 for the current vendor-recommended update path.