CVE-2021-40354: A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.8), Teamcenter V13.0 (All versions < V13.0.0.7), Teamcenter V13.1 (All versions…

PriorityP339high7.1CVSS 3.1

AVNACLPRLUINSUCHILAN

EPSS

0.58%

43.9th percentile

A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.8), Teamcenter V13.0 (All versions < V13.0.0.7), Teamcenter V13.1 (All versions < V13.1.0.5), Teamcenter V13.2 (All versions < 13.2.0.2). The "surrogate" functionality on the user profile of the application does not perform sufficient access control that could lead to an account takeover. Any profile on the application can perform this attack and access any other user assigned tasks via the "inbox/surrogate tasks".

Affected

8 ranges

Vendor	Product	Version range	Fixed in
siemens	teamcenter_v12.4	—	—
siemens	teamcenter_v13.0	—	—
siemens	teamcenter_v13.1	—	—
siemens	teamcenter_v13.2	—	—
siemens	teamcenter_visualization	>= 12.4.0 < 12.4.0.8	12.4.0.8
siemens	teamcenter_visualization	>= 13.0.0 < 13.0.0.7	13.0.0.7
siemens	teamcenter_visualization	>= 13.1.0 < 13.1.0.5	13.1.0.5
siemens	teamcenter_visualization	>= 13.2.0 < 13.2.0.2	13.2.0.2

CVSS provenance

nvdv3.17.1HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

nvdv2.05.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.