CVE-2021-40354: High severity Siemens Teamcenter Visualization vulnerability
A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.8), Teamcenter V13.0 (All versions < V13.0.0.7), Teamcenter V13.1 (All versions < V13.1.0.5), Teamcenter V13.2 (All versions < 13.2.0.2). The "surrogate" functionality on the user profile of the application does not perform sufficient access control that could lead to an account takeover. Any profile on the application can perform this attack and access any other user assigned tasks via the "inbox/surrogate tasks".
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-40354?
CVE-2021-40354 is considered a critical vulnerability due to its impact on user profile security in affected Teamcenter versions.
How do I fix CVE-2021-40354?
To remediate CVE-2021-40354, upgrade to Teamcenter versions V12.4.0.8 or later, V13.0.0.7 or later, V13.1.0.5 or later, or V13.2.0.2 or later.
Which versions of Teamcenter are affected by CVE-2021-40354?
CVE-2021-40354 affects Teamcenter V12.4 (all versions prior to V12.4.0.8), V13.0 (all versions prior to V13.0.0.7), V13.1 (all versions prior to V13.1.0.5), and V13.2 (all versions prior to V13.2.0.2).
What component of Teamcenter does CVE-2021-40354 impact?
CVE-2021-40354 impacts the 'surrogate' functionality on the user profile management component of Teamcenter.
Is a workaround available for CVE-2021-40354?
There are no known workarounds for CVE-2021-40354; the recommended action is to update to a patched version.