XML External Entity Injection in Teamcenter by Siemens

CVE-2022-29801

Summary

A vulnerability has been discovered in Siemens Teamcenter that involves XML External Entity Injection (XXE). This flaw allows attackers to exploit the application's XML parser by injecting malicious XML content. As a result, unauthorized users may gain access to sensitive files on the application server's filesystem, which could lead to further exploitation of the server environment. This issue affects Teamcenter versions prior to V12.4.0.13 and V13.0.0.9, highlighting the importance of ensuring timely updates and patches to mitigate potential security risks.

References