CVE-2021-40355

mediumPriorität · verfolgen · 35EPSS 0.008 · 57. PerzentilDEEUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
0.80% (57th) EPSS
CVSS 6.5 · medium
Is it mine?
20 products
Prüfe deine Angriffsfläche
Who says so?
5 sources
cnnvd · enisa_euvd · cisa_csaf_ot · nvd

EPSS · bewertet 2026-10-28

A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.8), Teamcenter V13.0 (All versions < V13.0.0.7), Teamcenter V13.1 (All versions < V13.1.0.5), Teamcenter V13.2 (All versions < 13.2.0.2). The affected application contains Insecure Direct Object Reference (IDOR) vulnerability that allows an attacker to use user-supplied input to access objects directly.

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

  • BehobenTeamcenter V12.4siemens_psirt

    Update to V12.4.0.8 or later version

  • BehobenTeamcenter V13.0siemens_psirt

    Update to V13.0.0.7 or later version

  • BehobenTeamcenter V13.1siemens_psirt

    Update to V13.1.0.5 or later version

  • BehobenTeamcenter V13.2siemens_psirt

    Update to V13.2.0.2 or later version

  • BehobenTeamcenter V12.4cisa_csaf_ot

    Update to V12.4.0.8 or later version

  • BehobenTeamcenter V13.0cisa_csaf_ot

    Update to V13.0.0.7 or later version

  • BehobenTeamcenter V13.1cisa_csaf_ot

    Update to V13.1.0.5 or later version

  • BehobenTeamcenter V13.2cisa_csaf_ot

    Update to V13.2.0.2 or later version

  • MitigationTeamcenter V12.4siemens_psirt

    Avoid to open untrusted files in Teamcenter

  • MitigationTeamcenter V13.0siemens_psirt

    Avoid to open untrusted files in Teamcenter

  • MitigationTeamcenter V13.1siemens_psirt

    Avoid to open untrusted files in Teamcenter

  • MitigationTeamcenter V13.2siemens_psirt

    Avoid to open untrusted files in Teamcenter

  • MitigationTeamcenter V12.4cisa_csaf_ot

    Avoid to open untrusted files in Teamcenter

  • MitigationTeamcenter V13.0cisa_csaf_ot

    Avoid to open untrusted files in Teamcenter

  • MitigationTeamcenter V13.1cisa_csaf_ot

    Avoid to open untrusted files in Teamcenter

  • MitigationTeamcenter V13.2cisa_csaf_ot

    Avoid to open untrusted files in Teamcenter

02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

8.8
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 6.5–8.8

v2.06.5mediumAV:N/AC:L/Au:S/C:P/I:P/A:Pprimary · NVD / NIST USAusnutzbarkeit 8 · Auswirkung 6.4
v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 2.8 · Auswirkung 5.9
v3.17.2highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:Csecondary · CISA US
v3.17.2highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:Csecondary · Siemens ProductCERT DE
v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)
03

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-639USCWE-639USCWE-639US
04

betroffene Produkte (20)

Betroffene Produkte und Versionsbereiche.

05

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

  • SSA-987403SSA-987403: Multiple Vulnerabilities in Teamcenter2021-09-14csaf · siemens_psirtDE

    Teamcenter is affected by three vulnerabilities namely incorrect privilege assignment, Insecure Direct Object Reference (IDOR) and XML External Entity Injection (XXE). Siemens has released updates for the affected products and recommends to update to the latest versions.

  • ICSA-21-257-08Siemens Teamcenter2021-09-14icsa · cisa_csaf_otUS

    Teamcenter is affected by three vulnerabilities namely incorrect privilege assignment, Insecure Direct Object Reference (IDOR) and XML External Entity Injection (XXE). Siemens has released updates for the affected products and recommends to update to the latest versions.

06

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

07

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdcisa_csaf_otnvdsiemens_psirtNVDCVE.orgMITRE
veröffentlicht 2021-09-14geändert 2026-06-17
08

Referenzen (4)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan