CVE-2020-26981
published 2021-01-12CVE-2020-26981: A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). When opening a specially crafted xml…
PriorityP339medium6.5CVSS 3.1
AVNACLPRNUIRSUCHINAN
EPSS
2.59%
83.4th percentile
A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). When opening a specially crafted xml file, the application could disclose arbitrary files to remote attackers. This is because of the passing of specially crafted content to the underlying XML parser without taking proper restrictions such as prohibiting an external dtd. (ZDI-CAN-11890)
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| siemens | jt2go | < 13.1.0 | 13.1.0 |
| siemens | jt2go | — | — |
| siemens | teamcenter_visualization | < 13.1.0 | 13.1.0 |
| siemens | teamcenter_visualization | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens JT2Go and Teamcenter Visualization (Update B)
cisa_ics·2021-02-09·CVSS 7.8
[HIGH] Siemens JT2Go and Teamcenter Visualization (Update B)
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Siemens JT2Go and Teamcenter Visualization (Update B)
Last RevisedMay 27, 2021
Alert CodeICSA-21-012-03
## 1. EXECUTIVE SUMMARY
- CVSS v3 7.8
- ATTENTION: Low skill level to exploit
- Vendor: Siemens
- Equipment: JT2Go and Teamcenter Visualization
--------- Begin Update B Part 1 of 2 ---------
- Vulnerabilities: Type Confusion, Improper Restriction of XML External Entity Reference, Out-of-Bounds Write, Heap-based Buffer Overflow, Stack-based Buffer Overflow, Untrusted Pointer Dereference, Out-of-Bounds Read
--------- End Update B Part 1 of 2 ---------
## 2. UPDATE INFORMA
GHSA
GHSA-cfxj-95gx-6rxg: A vulnerability has been identified in JT2Go (All Versions < V13
ghsa_unreviewed·2022-05-24
CVE-2020-26981 [MEDIUM] CWE-611 GHSA-cfxj-95gx-6rxg: A vulnerability has been identified in JT2Go (All Versions < V13
A vulnerability has been identified in JT2Go (All Versions < V13.1.0), Teamcenter Visualization (All Versions < V13.1.0). When opening a specially crafted xml file, the application could disclose arbitrary files to remote attackers. This is because of the passing of specially crafted content to the underlying XML parser without taking proper restrictions such as prohibiting an external dtd.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-01-12
Published