{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited.",
      "tlp": {
        "label": "WHITE"
      }
    },
    "notes": [
      {
        "category": "summary",
        "text": "Teamcenter is affected by two security vulnerabilities in the File\nService Cache service that could lead to command injection and denial\nof service issues.     Siemens has released updates for the affected\nproducts and recommends to update to the latest versions.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect\nnetwork access to devices with appropriate mechanisms. In order to\noperate the devices in a protected IT environment, Siemens recommends\nto configure the environment according to Siemens\u0027 operational\nguidelines for Industrial Security (Download:\nhttps://www.siemens.com/cert/operational-guidelines-industrial-\nsecurity), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found\nat: https://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "productcert@siemens.com",
      "name": "Siemens ProductCERT",
      "namespace": "https://www.siemens.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-759952: Command Injection and Denial of Service Vulnerability in Teamcenter - PDF Version",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-759952.pdf"
      },
      {
        "category": "self",
        "summary": "SSA-759952: Command Injection and Denial of Service Vulnerability in Teamcenter - TXT Version",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-759952.txt"
      },
      {
        "category": "self",
        "summary": "SSA-759952: Command Injection and Denial of Service Vulnerability in Teamcenter - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-759952.json"
      }
    ],
    "title": "SSA-759952: Command Injection and Denial of Service Vulnerability in Teamcenter",
    "tracking": {
      "current_release_date": "2022-08-09T00:00:00Z",
      "generator": {
        "engine": {
          "name": "Siemens ProductCERT CSAF Generator",
          "version": "1"
        }
      },
      "id": "SSA-759952",
      "initial_release_date": "2022-08-09T00:00:00Z",
      "revision_history": [
        {
          "date": "2022-08-09T00:00:00Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c V12.4.0.15",
                "product": {
                  "name": "Teamcenter V12.4",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "Teamcenter V12.4"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c V13.0.0.10",
                "product": {
                  "name": "Teamcenter V13.0",
                  "product_id": "2"
                }
              }
            ],
            "category": "product_name",
            "name": "Teamcenter V13.0"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c V13.1.0.10",
                "product": {
                  "name": "Teamcenter V13.1",
                  "product_id": "3"
                }
              }
            ],
            "category": "product_name",
            "name": "Teamcenter V13.1"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c V13.2.0.9",
                "product": {
                  "name": "Teamcenter V13.2",
                  "product_id": "4"
                }
              }
            ],
            "category": "product_name",
            "name": "Teamcenter V13.2"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c V13.3.0.5",
                "product": {
                  "name": "Teamcenter V13.3",
                  "product_id": "5"
                }
              }
            ],
            "category": "product_name",
            "name": "Teamcenter V13.3"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c V14.0.0.2",
                "product": {
                  "name": "Teamcenter V14.0",
                  "product_id": "6"
                }
              }
            ],
            "category": "product_name",
            "name": "Teamcenter V14.0"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-34660",
      "cwe": {
        "id": "CWE-77",
        "name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "File Server Cache service in Teamcenter consist of a functionality that is vulnerable to command injection. This could potentially allow an attacker to perform remote code execution.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Harden the application\u2019s host to prevent local access by untrusted\npersonnel",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6"
          ]
        },
        {
          "category": "mitigation",
          "details": "Limit access to port 4544/tcp to specific IP addresses, e.g. with a\nfirewall",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "Currently no fix is planned",
          "product_ids": [
            "5"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V12.4.0.15 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.sw.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V13.0.0.10 or later version",
          "product_ids": [
            "2"
          ],
          "url": "https://support.sw.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V13.1.0.10 or later version",
          "product_ids": [
            "3"
          ],
          "url": "https://support.sw.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V13.2.0.9 or later version",
          "product_ids": [
            "4"
          ],
          "url": "https://support.sw.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V13.3.0.5 or later version",
          "product_ids": [
            "5"
          ],
          "url": "https://support.sw.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V14.0.0.2 or later version",
          "product_ids": [
            "6"
          ],
          "url": "https://support.sw.siemens.com/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6"
          ]
        }
      ],
      "title": "CVE-2022-34660"
    },
    {
      "cve": "CVE-2022-34661",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "File Server Cache service in Teamcenter is vulnerable to denial of service by entering infinite loops and using up CPU cycles. This could allow an attacker to cause denial of service condition.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Harden the application\u2019s host to prevent local access by untrusted\npersonnel",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6"
          ]
        },
        {
          "category": "mitigation",
          "details": "Limit access to port 4544/tcp to specific IP addresses, e.g. with a\nfirewall",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "Currently no fix is planned",
          "product_ids": [
            "5"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V12.4.0.15 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.sw.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V13.0.0.10 or later version",
          "product_ids": [
            "2"
          ],
          "url": "https://support.sw.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V13.1.0.10 or later version",
          "product_ids": [
            "3"
          ],
          "url": "https://support.sw.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V13.2.0.9 or later version",
          "product_ids": [
            "4"
          ],
          "url": "https://support.sw.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V13.3.0.5 or later version",
          "product_ids": [
            "5"
          ],
          "url": "https://support.sw.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V14.0.0.2 or later version",
          "product_ids": [
            "6"
          ],
          "url": "https://support.sw.siemens.com/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6"
          ]
        }
      ],
      "title": "CVE-2022-34661"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Teamcenter V12.4 versions ant\u00e9rieures \u00e0 12.4.0.15",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "CP-8000 (6MF2101-1AB10-0AA0) toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SCALANCE W-1700 IEEE 802.11ac toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Soft Starter ES versions ant\u00e9rieures \u00e0 16",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Soft Starter ES versions ant\u00e9rieures \u00e0 15.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SCALANCE XB-200 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SCALANCE XR-500 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Teamcenter V13.1 versions ant\u00e9rieures \u00e0 13.1.0.10",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "CP-8021 (6MF2802-1AA00) toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Simcenter STAR-CCM+",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "CP-8022 (6MF2802-2AA00) toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SCALANCE XC-200 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SCALANCE XP-200 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SCALANCE XM-400 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SCALANCE XF-200BA toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Teamcenter V13.0 versions ant\u00e9rieures \u00e0 13.0.0.10",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "CP-8000 (6MF2101-0AB10-0AA0) toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SCALANCE W-700 IEEE 802.11n toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SCALANCE M-800 / S615 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMOCODE ES versions ant\u00e9rieures \u00e0 16",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Teamcenter V13.3 versions ant\u00e9rieures \u00e0 13.3.0.5",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SCALANCE W-700 IEEE 802.11ax toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SCALANCE XR-300WG toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Teamcenter V13.2 versions ant\u00e9rieures \u00e0 13.2.0.9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMOCODE ES versions ant\u00e9rieures \u00e0 15.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Teamcenter V14.0 versions ant\u00e9rieures \u00e0 14.0.0.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SCALANCE SC-600 versions ant\u00e9rieures \u00e0 2.3.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-46304",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-46304"
    },
    {
      "name": "CVE-2020-7587",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-7587"
    },
    {
      "name": "CVE-2020-7588",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-7588"
    },
    {
      "name": "CVE-2022-34661",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-34661"
    },
    {
      "name": "CVE-2022-36325",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-36325"
    },
    {
      "name": "CVE-2020-7581",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-7581"
    },
    {
      "name": "CVE-2022-36323",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-36323"
    },
    {
      "name": "CVE-2022-36324",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-36324"
    },
    {
      "name": "CVE-2022-34659",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-34659"
    },
    {
      "name": "CVE-2022-34660",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-34660"
    }
  ],
  "links": [],
  "reference": "CERTFR-2022-AVI-718",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2022-08-09T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSiemens. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0\ndistance et un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Siemens",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-841348 du 9 ao\u00fbt 2022",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-841348.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-555707 du 9 ao\u00fbt 2022",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-555707.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-759952 du 9 ao\u00fbt 2022",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-759952.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-185638 du 9 ao\u00fbt 2022",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-185638.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-710008 du 9 ao\u00fbt 2022",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-710008.html"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Teamcenter V12.4 versions ant\u00e9rieures \u00e0 12.4.0.15",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "CP-8000 (6MF2101-1AB10-0AA0) toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SCALANCE W-1700 IEEE 802.11ac toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Soft Starter ES versions ant\u00e9rieures \u00e0 16",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Soft Starter ES versions ant\u00e9rieures \u00e0 15.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SCALANCE XB-200 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SCALANCE XR-500 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Teamcenter V13.1 versions ant\u00e9rieures \u00e0 13.1.0.10",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "CP-8021 (6MF2802-1AA00) toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Simcenter STAR-CCM+",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "CP-8022 (6MF2802-2AA00) toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SCALANCE XC-200 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SCALANCE XP-200 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SCALANCE XM-400 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SCALANCE XF-200BA toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Teamcenter V13.0 versions ant\u00e9rieures \u00e0 13.0.0.10",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "CP-8000 (6MF2101-0AB10-0AA0) toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SCALANCE W-700 IEEE 802.11n toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SCALANCE M-800 / S615 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMOCODE ES versions ant\u00e9rieures \u00e0 16",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Teamcenter V13.3 versions ant\u00e9rieures \u00e0 13.3.0.5",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SCALANCE W-700 IEEE 802.11ax toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SCALANCE XR-300WG toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Teamcenter V13.2 versions ant\u00e9rieures \u00e0 13.2.0.9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMOCODE ES versions ant\u00e9rieures \u00e0 15.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Teamcenter V14.0 versions ant\u00e9rieures \u00e0 14.0.0.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SCALANCE SC-600 versions ant\u00e9rieures \u00e0 2.3.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-46304",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-46304"
    },
    {
      "name": "CVE-2020-7587",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-7587"
    },
    {
      "name": "CVE-2020-7588",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-7588"
    },
    {
      "name": "CVE-2022-34661",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-34661"
    },
    {
      "name": "CVE-2022-36325",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-36325"
    },
    {
      "name": "CVE-2020-7581",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-7581"
    },
    {
      "name": "CVE-2022-36323",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-36323"
    },
    {
      "name": "CVE-2022-36324",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-36324"
    },
    {
      "name": "CVE-2022-34659",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-34659"
    },
    {
      "name": "CVE-2022-34660",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-34660"
    }
  ],
  "links": [],
  "reference": "CERTFR-2022-AVI-718",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2022-08-09T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSiemens. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0\ndistance et un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Siemens",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-841348 du 9 ao\u00fbt 2022",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-841348.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-555707 du 9 ao\u00fbt 2022",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-555707.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-759952 du 9 ao\u00fbt 2022",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-759952.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-185638 du 9 ao\u00fbt 2022",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-185638.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-710008 du 9 ao\u00fbt 2022",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-710008.html"
    }
  ]
}

{
  "document": {
    "acknowledgments": [
      {
        "organization": "Siemens ProductCERT",
        "summary": "reporting these vulnerabilities to CISA."
      },
      {
        "names": [
          "Han Lee"
        ],
        "organization": "Apple Information Security",
        "summary": "reporting the vulnerabilities"
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "notes": [
      {
        "category": "summary",
        "text": "Teamcenter is affected by two security vulnerabilities in the File\nService Cache service that could lead to command injection and denial\nof service issues.     Siemens has released updates for the affected\nproducts and recommends to update to the latest versions.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect\nnetwork access to devices with appropriate mechanisms. In order to\noperate the devices in a protected IT environment, Siemens recommends\nto configure the environment according to Siemens\u0027 operational\nguidelines for Industrial Security (Download:\nhttps://www.siemens.com/cert/operational-guidelines-industrial-\nsecurity), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found\nat: https://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      },
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "other",
        "text": "This CISA CSAF advisory was converted from Siemens ProductCERT\u0027s CSAF advisory.",
        "title": "Advisory Conversion Disclaimer"
      },
      {
        "category": "other",
        "text": "Multiple",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "Germany",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "central@cisa.dhs.gov",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-759952: Command Injection and Denial of Service Vulnerability in Teamcenter - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-759952.json"
      },
      {
        "category": "self",
        "summary": "SSA-759952: Command Injection and Denial of Service Vulnerability in Teamcenter - TXT Version",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-759952.txt"
      },
      {
        "category": "self",
        "summary": "SSA-759952: Command Injection and Denial of Service Vulnerability in Teamcenter - PDF Version",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-759952.pdf"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-22-223-02 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2022/icsa-22-223-02.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-22-223-02 - Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-223-02"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/topics/industrial-control-systems"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
      }
    ],
    "title": "Siemens Teamcenter",
    "tracking": {
      "current_release_date": "2022-08-09T00:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSA-22-223-02",
      "initial_release_date": "2022-08-09T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2022-08-09T00:00:00.000000Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV12.4.0.15",
                "product": {
                  "name": "Teamcenter V12.4",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "Teamcenter V12.4"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV13.0.0.10",
                "product": {
                  "name": "Teamcenter V13.0",
                  "product_id": "CSAFPID-0002"
                }
              }
            ],
            "category": "product_name",
            "name": "Teamcenter V13.0"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV13.1.0.10",
                "product": {
                  "name": "Teamcenter V13.1",
                  "product_id": "CSAFPID-0003"
                }
              }
            ],
            "category": "product_name",
            "name": "Teamcenter V13.1"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV13.2.0.9",
                "product": {
                  "name": "Teamcenter V13.2",
                  "product_id": "CSAFPID-0004"
                }
              }
            ],
            "category": "product_name",
            "name": "Teamcenter V13.2"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV13.3.0.5",
                "product": {
                  "name": "Teamcenter V13.3",
                  "product_id": "CSAFPID-0005"
                }
              }
            ],
            "category": "product_name",
            "name": "Teamcenter V13.3"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV14.0.0.2",
                "product": {
                  "name": "Teamcenter V14.0",
                  "product_id": "CSAFPID-0006"
                }
              }
            ],
            "category": "product_name",
            "name": "Teamcenter V14.0"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-34660",
      "cwe": {
        "id": "CWE-77",
        "name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "File Server Cache service in Teamcenter consist of a functionality that is vulnerable to command injection. This could potentially allow an attacker to perform remote code execution.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Harden the application\u2019s host to prevent local access by untrusted\npersonnel",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006"
          ]
        },
        {
          "category": "mitigation",
          "details": "Limit access to port 4544/tcp to specific IP addresses, e.g. with a\nfirewall",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "Currently no fix is planned",
          "product_ids": [
            "CSAFPID-0005"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V12.4.0.15 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.sw.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V13.0.0.10 or later version",
          "product_ids": [
            "CSAFPID-0002"
          ],
          "url": "https://support.sw.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V13.1.0.10 or later version",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://support.sw.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V13.2.0.9 or later version",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://support.sw.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V13.3.0.5 or later version",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://support.sw.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V14.0.0.2 or later version",
          "product_ids": [
            "CSAFPID-0006"
          ],
          "url": "https://support.sw.siemens.com/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006"
          ]
        }
      ],
      "title": "CVE-2022-34660"
    },
    {
      "cve": "CVE-2022-34661",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "File Server Cache service in Teamcenter is vulnerable to denial of service by entering infinite loops and using up CPU cycles. This could allow an attacker to cause denial of service condition.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Harden the application\u2019s host to prevent local access by untrusted\npersonnel",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006"
          ]
        },
        {
          "category": "mitigation",
          "details": "Limit access to port 4544/tcp to specific IP addresses, e.g. with a\nfirewall",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "Currently no fix is planned",
          "product_ids": [
            "CSAFPID-0005"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V12.4.0.15 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.sw.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V13.0.0.10 or later version",
          "product_ids": [
            "CSAFPID-0002"
          ],
          "url": "https://support.sw.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V13.1.0.10 or later version",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://support.sw.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V13.2.0.9 or later version",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://support.sw.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V13.3.0.5 or later version",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://support.sw.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V14.0.0.2 or later version",
          "product_ids": [
            "CSAFPID-0006"
          ],
          "url": "https://support.sw.siemens.com/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006"
          ]
        }
      ],
      "title": "CVE-2022-34661"
    }
  ]
}

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:siemens:teamcenter:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1AAD90FE-E22B-4801-8306-BD74485FCD1C",
              "versionEndExcluding": "12.4.0.15",
              "versionStartIncluding": "12.4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:siemens:teamcenter:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "76CF7820-950C-4DF1-BD78-6839BD44F4C6",
              "versionEndExcluding": "13.0.0.10",
              "versionStartIncluding": "13.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:siemens:teamcenter:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A6DA90DF-92D5-4091-97EC-B1BC0DD54981",
              "versionEndExcluding": "13.1.0.10",
              "versionStartIncluding": "13.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:siemens:teamcenter:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6B6BC3EC-D245-410B-8332-3A5434CE75C3",
              "versionEndExcluding": "13.2.0.9",
              "versionStartIncluding": "13.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:siemens:teamcenter:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BD3BE368-9523-45F2-B249-29B88F73C259",
              "versionEndExcluding": "13.3.0.5",
              "versionStartIncluding": "13.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:siemens:teamcenter:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A83E678F-3A9A-4F07-9D03-C224741877C4",
              "versionEndExcluding": "14.0.0.2",
              "versionStartIncluding": "14.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability has been identified in Teamcenter V12.4 (All versions \u003c V12.4.0.15), Teamcenter V13.0 (All versions \u003c V13.0.0.10), Teamcenter V13.1 (All versions \u003c V13.1.0.10), Teamcenter V13.2 (All versions \u003c V13.2.0.9), Teamcenter V13.3 (All versions \u003c V13.3.0.5), Teamcenter V14.0 (All versions \u003c V14.0.0.2). File Server Cache service in Teamcenter is vulnerable to denial of service by entering infinite loops and using up CPU cycles. This could allow an attacker to cause denial of service condition."
    },
    {
      "lang": "es",
      "value": "Se ha identificado una vulnerabilidad en Teamcenter V12.4 (Todas las versiones anteriores a V12.4.0.15), Teamcenter V13.0 (Todas las versiones anteriores a V13.0.0.10), Teamcenter V13.1 (Todas las versiones anteriores a V13.1.0.10), Teamcenter V13.2 (Todas las versiones anteriores a V13.2.0.9), Teamcenter V13.3 (Todas las versiones anteriores a V13.3.0.5), Teamcenter V14.0 (Todas las versiones anteriores a V14.0.0.2). El servicio de cach\u00e9 del servidor de archivos en Teamcenter es vulnerable a una denegaci\u00f3n de servicio al entrar en bucles infinitos y consumir ciclos de CPU. Esto podr\u00eda permitir a un atacante causar una condici\u00f3n de denegaci\u00f3n de servicio"
    }
  ],
  "id": "CVE-2022-34661",
  "lastModified": "2025-09-03T19:15:33.657",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2022-08-10T12:15:12.257",
  "references": [
    {
      "source": "productcert@siemens.com",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-759952.pdf"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-759952.pdf"
    }
  ],
  "sourceIdentifier": "productcert@siemens.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-835"
        }
      ],
      "source": "productcert@siemens.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-34661"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-835"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-08-10T12:15:00Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability has been identified in Teamcenter V12.4 (All versions \u003c V12.4.0.15), Teamcenter V13.0 (All versions \u003c V13.0.0.10), Teamcenter V13.1 (All versions \u003c V13.1.0.10), Teamcenter V13.2 (All versions \u003c V13.2.0.9), Teamcenter V13.3 (All versions \u003c V13.3.0.5), Teamcenter V14.0 (All versions \u003c V14.0.0.2). File Server Cache service in Teamcenter is vulnerable to denial of service by entering infinite loops and using up CPU cycles. This could allow an attacker to cause denial of service condition.",
  "id": "GHSA-ww5r-x8xx-g992",
  "modified": "2022-08-13T00:00:35Z",
  "published": "2022-08-11T00:00:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34661"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-759952.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2022-34661"
    }
  },
  "description": "Teamcenter\u8f6f\u4ef6\u662f\u4e00\u4e2a\u73b0\u4ee3\u5316\u7684\u3001\u9002\u5e94\u6027\u5f3a\u7684\u4ea7\u54c1\u751f\u547d\u5468\u671f\u7ba1\u7406 (PLM) \u7cfb\u7edf\uff0c\u5b83\u901a\u8fc7\u6570\u5b57\u7ebf\u7a0b\u5c06\u4eba\u5458\u548c\u6d41\u7a0b\u8de8\u529f\u80fd\u5b64\u5c9b\u8fde\u63a5\u8d77\u6765\uff0c\u4ee5\u5b9e\u73b0\u521b\u65b0\u3002\n\nSiemens Teamcenter\u5b58\u5728\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u9020\u6210\u62d2\u7edd\u670d\u52a1\u60c5\u51b5\u3002",
  "formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u4f9b\u5e94\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u516c\u544a\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttps://cert-portal.siemens.com/productcert/html/ssa-759952.html",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2022-56472",
  "openTime": "2022-08-12",
  "patchDescription": "Teamcenter\u8f6f\u4ef6\u662f\u4e00\u4e2a\u73b0\u4ee3\u5316\u7684\u3001\u9002\u5e94\u6027\u5f3a\u7684\u4ea7\u54c1\u751f\u547d\u5468\u671f\u7ba1\u7406 (PLM) \u7cfb\u7edf\uff0c\u5b83\u901a\u8fc7\u6570\u5b57\u7ebf\u7a0b\u5c06\u4eba\u5458\u548c\u6d41\u7a0b\u8de8\u529f\u80fd\u5b64\u5c9b\u8fde\u63a5\u8d77\u6765\uff0c\u4ee5\u5b9e\u73b0\u521b\u65b0\u3002\r\n\r\nSiemens Teamcenter\u5b58\u5728\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u9020\u6210\u62d2\u7edd\u670d\u52a1\u60c5\u51b5\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Siemens Teamcenter\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Siemens Teamcenter V13.1",
      "Siemens Teamcenter V14.0",
      "Siemens Teamcenter V12.4",
      "Siemens Teamcenter V13.0",
      "Siemens Teamcenter V13.2",
      "Siemens Teamcenter V13.3"
    ]
  },
  "referenceLink": "https://cert-portal.siemens.com/productcert/html/ssa-759952.html",
  "serverity": "\u9ad8",
  "submitTime": "2022-08-09",
  "title": "Siemens Teamcenter\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e"
}

{
  "GSD": {
    "alias": "CVE-2022-34661",
    "description": "A vulnerability has been identified in Teamcenter V12.4 (All versions \u003c V12.4.0.15), Teamcenter V13.0 (All versions \u003c V13.0.0.10), Teamcenter V13.1 (All versions \u003c V13.1.0.10), Teamcenter V13.2 (All versions \u003c V13.2.0.9), Teamcenter V13.3 (All versions \u003c V13.3.0.5), Teamcenter V14.0 (All versions \u003c V14.0.0.2). File Server Cache service in Teamcenter is vulnerable to denial of service by entering infinite loops and using up CPU cycles. This could allow an attacker to cause denial of service condition.",
    "id": "GSD-2022-34661"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2022-34661"
      ],
      "details": "A vulnerability has been identified in Teamcenter V12.4 (All versions \u003c V12.4.0.15), Teamcenter V13.0 (All versions \u003c V13.0.0.10), Teamcenter V13.1 (All versions \u003c V13.1.0.10), Teamcenter V13.2 (All versions \u003c V13.2.0.9), Teamcenter V13.3 (All versions \u003c V13.3.0.5), Teamcenter V14.0 (All versions \u003c V14.0.0.2). File Server Cache service in Teamcenter is vulnerable to denial of service by entering infinite loops and using up CPU cycles. This could allow an attacker to cause denial of service condition.",
      "id": "GSD-2022-34661",
      "modified": "2023-12-13T01:19:19.269052Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "productcert@siemens.com",
        "ID": "CVE-2022-34661",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Teamcenter V12.4",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "All versions \u003c V12.4.0.15"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Teamcenter V13.0",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "All versions \u003c V13.0.0.10"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Teamcenter V13.1",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "All versions \u003c V13.1.0.10"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Teamcenter V13.2",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "All versions \u003c V13.2.0.9"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Teamcenter V13.3",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "All versions \u003c V13.3.0.5"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Teamcenter V14.0",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "All versions \u003c V14.0.0.2"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Siemens"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "A vulnerability has been identified in Teamcenter V12.4 (All versions \u003c V12.4.0.15), Teamcenter V13.0 (All versions \u003c V13.0.0.10), Teamcenter V13.1 (All versions \u003c V13.1.0.10), Teamcenter V13.2 (All versions \u003c V13.2.0.9), Teamcenter V13.3 (All versions \u003c V13.3.0.5), Teamcenter V14.0 (All versions \u003c V14.0.0.2). File Server Cache service in Teamcenter is vulnerable to denial of service by entering infinite loops and using up CPU cycles. This could allow an attacker to cause denial of service condition."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-759952.pdf",
            "refsource": "MISC",
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-759952.pdf"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:siemens:teamcenter:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "14.0.0.2",
                "versionStartIncluding": "14.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:siemens:teamcenter:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "13.3.0.5",
                "versionStartIncluding": "13.3",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:siemens:teamcenter:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "13.2.0.9",
                "versionStartIncluding": "13.2",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:siemens:teamcenter:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "13.1.0.10",
                "versionStartIncluding": "13.1",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:siemens:teamcenter:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "13.0.0.10",
                "versionStartIncluding": "13.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:siemens:teamcenter:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "12.4.0.15",
                "versionStartIncluding": "12.4",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "productcert@siemens.com",
          "ID": "CVE-2022-34661"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "A vulnerability has been identified in Teamcenter V12.4 (All versions \u003c V12.4.0.15), Teamcenter V13.0 (All versions \u003c V13.0.0.10), Teamcenter V13.1 (All versions \u003c V13.1.0.10), Teamcenter V13.2 (All versions \u003c V13.2.0.9), Teamcenter V13.3 (All versions \u003c V13.3.0.5), Teamcenter V14.0 (All versions \u003c V14.0.0.2). File Server Cache service in Teamcenter is vulnerable to denial of service by entering infinite loops and using up CPU cycles. This could allow an attacker to cause denial of service condition."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-835"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "N/A",
              "refsource": "CONFIRM",
              "tags": [
                "Mitigation",
                "Vendor Advisory"
              ],
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-759952.pdf"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2022-08-12T17:39Z",
      "publishedDate": "2022-08-10T12:15Z"
    }
  }
}