Our takeCISA reports a reflected XSS in Siemens Teamcenter's auth redirect that lets unauthenticated attackers inject JS into authenticated sessions. Siemens has patched it; update now.Cyber Resilience desk
Sources (1)
- cisa_ics · cisa_ics
What this means for you — Security leader:Siemens released a patch for a reflected XSS in Teamcenter's authentication redirect (/auth/). Apply the update immediately if you run self-hosted Teamcenter; test in a staging environment first.
What this means for you — Lean IT orgs:If you use Siemens Teamcenter, check for the available security update and install it. Most lean-IT teams without this software can ignore this advisory.
What this means for you — MSP:Patch Siemens Teamcenter for the reflected XSS in its authentication flow if any client runs it on-premises. Confirm the fix version from the Siemens advisory and schedule updates during maintenance windows.
What this means for you — Researcher:CISA reports a reflected XSS in Siemens Teamcenter authentication redirect that lets unauthenticated attackers inject JavaScript into authenticated sessions. Siemens has issued a patch.