Siemens Teamcenter 2412.x < 2412.0013 / 2506.x < 2506.0010 / 2512.x < 2512.2607 / 2606.x < 2606.2607 XSS (SSA-157465)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(346900);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/17");

  script_cve_id("CVE-2026-58113");

  script_name(english:"Siemens Teamcenter 2412.x < 2412.0013 / 2506.x < 2506.0010 / 2512.x < 2512.2607 / 2606.x < 2606.2607 XSS (SSA-157465)");

  script_set_attribute(attribute:"synopsis", value:
"An application installed on the remote host is affected by a cross-site scripting vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Siemens Teamcenter installed on the remote host is 2412.x prior to 2412.0013, or 2506.x prior to
2506.0010, or 2512.x prior to 2512.2607, or 2606.x prior to 2606.2607. It is, therefore, affected by a reflected
cross-site scripting vulnerability. Affected applications do not properly encode user-supplied input reflected into
HTML attribute contexts within the authentication redirect flow (/auth/ endpoint). This could allow an unauthenticated
remote attacker to inject arbitrary JavaScript into the browser of an authenticated user who loads a crafted URL,
enabling the attacker to perform actions within the victim's Teamcenter session.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/html/ssa-157465.html");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Siemens Teamcenter version 2412.0013, 2506.0010, 2512.2607, 2606.2607, or later.");
  script_set_attribute(attribute:"agent", value:"windows");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-58113");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/17");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:siemens:teamcenter");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("siemens_teamcenter_installed.nbin");
  script_require_keys("installed_sw/Siemens Teamcenter");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Siemens Teamcenter', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'min_version': '2412.0', 'fixed_version': '2412.0013'},
        {'min_version': '2506.0', 'fixed_version': '2506.0010'},
        {'min_version': '2512.0', 'fixed_version': '2512.2607'},
        {'min_version': '2606.0', 'fixed_version': '2606.2607'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING, flags:{'xss':TRUE});
vdf::handle_check_and_report_errors(vdf_result:result);