CVE-2021-40354

CVE-2021-40354 affects Siemens Teamcenter (multiple v12.4/13.x releases) where the surrogate feature on a user profile lacks sufficient access control, enabling an account takeover by any profile to view or act on tasks in inbox/surrogate tasks. The root cause is improper access control within th...

Siemens Teamcenter

1. EXECUTIVE SUMMARY CVSS v3 7.2 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: Teamcenter Vulnerability: Privilege Defined with Unsafe Actions, Authorization Bypass Through User-Controlled Key, Improper Restriction of XML External Entity Reference 2. RISK...