CVE-2021-33710 Cross-site scripting in Teamcenter Active Workspace V4

What is CVE-2021-33710?

CVE-2021-33710 is a medium-severity cross-site scripting vulnerability in Siemens Teamcenter Active Workspace V4, published on 13 Jul 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A vulnerability has been identified in Teamcenter Active Workspace V4 (All versions < V4.3.9), Teamcenter Active Workspace V5.0 (All versions < V5.0.7), Teamcenter Active Workspace V5.1 (All versions < V5.1.4). A reflected cross-site scripting (XSS) vulnerability exists in the web interface of the affected devices that could allow an attacker to execute malicious JavaScript code by tricking users into accessing a malicious link.

Weakness: CWE-79

Which versions are affected by CVE-2021-33710?

It affects 1 product.

Products include Siemens Teamcenter Active Workspace.

How do I fix CVE-2021-33710?

No fix has been published for CVE-2021-33710 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2021-33710 being exploited?

There is no known exploitation of CVE-2021-33710 in the wild and no public exploit code.

Other vulnerabilities in Siemens Teamcenter Active Workspace V4

• CVE-2021-41547 Path traversal in Teamcenter Active Workspace V4.3 High 7.2
• CVE-2022-32145 Cross-site scripting in Teamcenter Active Workspace V5.2 Medium 6.1
• CVE-2021-33711 Information disclosure in Teamcenter Active Workspace V4 Medium 5.3
• CVE-2021-40357 Path traversal in Teamcenter Active Workspace V4.3 Medium 4.9
• CVE-2021-33709 Information disclosure in Teamcenter Active Workspace V4 Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-rrwx-3wc4-g6pq.