CVE-2022-29801 XML external entity in Teamcenter V12.4

What is CVE-2022-29801?

CVE-2022-29801 is a high-severity vulnerability in Siemens Teamcenter V12.4, published on 10 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.13), Teamcenter V13.0 (All versions < V13.0.0.9). The application contains a XML External Entity Injection (XXE) vulnerability. This could allow an attacker to view files on the application server filesystem.

Weakness: CWE-611

Which versions are affected by CVE-2022-29801?

It affects 1 product.

Products include Siemens Teamcenter.

How do I fix CVE-2022-29801?

No fix has been published for CVE-2022-29801 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-29801 being exploited?

There is no known exploitation of CVE-2022-29801 in the wild and no public exploit code.

Other vulnerabilities in Siemens Teamcenter V12.4

• CVE-2022-31619 Hardcoded credentials in Teamcenter V12.4 High 8.8
• CVE-2026-33893 Hardcoded credentials in Teamcenter V2312 High 8.7
• CVE-2026-33862 Cross-site scripting in Teamcenter V2312 High 8.5
• CVE-2022-24290 Memory corruption in Teamcenter V12.4 High 7.5
• CVE-2022-34660 Command injection in Teamcenter V12.4 Medium 6.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-h2jw-98ww-486c.