CVE-2022-32145 Cross-site scripting in Teamcenter Active Workspace V5.2

What is CVE-2022-32145?

CVE-2022-32145 is a medium-severity cross-site scripting vulnerability in Siemens Teamcenter Active Workspace V5.2, published on 14 Jun 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A vulnerability has been identified in Teamcenter Active Workspace V5.2 (All versions < V5.2.9), Teamcenter Active Workspace V6.0 (All versions < V6.0.3). A reflected cross-site scripting (XSS) vulnerability exists in the web interface of the affected application that could allow an attacker to execute malicious code by tricking users into accessing a malicious link.

Weakness: CWE-79

Which versions are affected by CVE-2022-32145?

It affects 1 product.

Products include Siemens Teamcenter Active Workspace.

How do I fix CVE-2022-32145?

No fix has been published for CVE-2022-32145 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2022-32145 being exploited?

There is no known exploitation of CVE-2022-32145 in the wild and no public exploit code.

Other vulnerabilities in Siemens Teamcenter Active Workspace V5.2

• CVE-2021-41547 Path traversal in Teamcenter Active Workspace V4.3 High 7.2
• CVE-2021-33710 Cross-site scripting in Teamcenter Active Workspace V4 Medium 6.1
• CVE-2021-33711 Information disclosure in Teamcenter Active Workspace V4 Medium 5.3
• CVE-2021-40357 Path traversal in Teamcenter Active Workspace V4.3 Medium 4.9
• CVE-2021-33709 Information disclosure in Teamcenter Active Workspace V4 Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-j8rg-hxhv-j879.