Riskcovery

CVE-2021-40354

State
Published
Severity
Not scored
Published
Sep 14, 2021
Updated
Aug 4, 2024
Reserved
Sep 1, 2021

Read the record on cve.org

Description

A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.8), Teamcenter V13.0 (All versions < V13.0.0.7), Teamcenter V13.1 (All versions < V13.1.0.5), Teamcenter V13.2 (All versions < 13.2.0.2). The "surrogate" functionality on the user profile of the application does not perform sufficient access control that could lead to an account takeover. Any profile on the application can perform this attack and access any other user assigned tasks via the "inbox/surrogate tasks".

Scores

The record has no CVSS score.

Weaknesses

  • CWE-267 Privilege Defined With Unsafe Actions

Affected Products

ProductVersions
Teamcenter V12.4Siemens
  • All versions < V12.4.0.8Affected
Teamcenter V13.0Siemens
  • All versions < V13.0.0.7Affected
Teamcenter V13.1Siemens
  • All versions < V13.1.0.5Affected
Teamcenter V13.2Siemens
  • All versions < 13.2.0.2Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.