Details of VAR-201807-1339

ID

VAR-201807-1339

CVE

CVE-2018-11450

TITLE

Siemens PLM Software TEAMCENTER Vulnerable to cross-site scripting

Trust: 0.8

sources: JVNDB: JVNDB-2018-007765

DESCRIPTION

A reflected Cross-Site-Scripting (XSS) vulnerability has been identified in Siemens PLM Software TEAMCENTER (V9.1.2.5). If a user visits the login portal through the URL crafted by the attacker, the attacker can insert html/javascript and thus alter/rewrite the login portal page. Siemens PLM Software TEAMCENTER V9.1.3 and newer are not affected. This product is mainly used to manage and share product designs, files, BOM And data etc. Attackers can use specially made URL Use this vulnerability to inject html or JavaScript Code, modify or rewrite the login page

Trust: 1.71

sources: NVD: CVE-2018-11450 // JVNDB: JVNDB-2018-007765 // VULHUB: VH-CVE-2018-11450

AFFECTED PRODUCTS

vendor:	siemens	model:	teamcenter product lifecycle management	scope:	lte	version:	9.1.2.5	Trust: 1.0
vendor:	siemens	model:	teamcenter	scope:	eq	version:	9.1.2.5	Trust: 0.8
vendor:	siemens	model:	teamcenter product lifecycle management	scope:	eq	version:	9.1.2.5	Trust: 0.6

sources: JVNDB: JVNDB-2018-007765 // CNNVD: CNNVD-201807-465 // NVD: CVE-2018-11450

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD:	CVE-2018-11450
value:	MEDIUM
Trust: 1.8
CNNVD:	CNNVD-201807-465
value:	MEDIUM
Trust: 0.6
VUL-HUB:	VH-CVE-2018-11450
value:	LOW RISK
Trust: 0.1

NVD:	CVE-2018-11450
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VH-CVE-2018-11450
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

NVD:	CVE-2018-11450
baseSeverity:	MEDIUM
baseScore:	6.1
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 1.8

sources: VULHUB: VH-CVE-2018-11450 // JVNDB: JVNDB-2018-007765 // CNNVD: CNNVD-201807-465 // NVD: CVE-2018-11450

PROBLEMTYPE DATA

problemtype:

CWE-79

Trust: 1.9

sources: VULHUB: VH-CVE-2018-11450 // JVNDB: JVNDB-2018-007765 // NVD: CVE-2018-11450

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201807-465

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-201807-465

CONFIGURATIONS

sources: NVD: CVE-2018-11450

PATCH

title:	Teamcenter	url:	https://www.plm.automation.siemens.com/global/en/products/teamcenter/	Trust: 0.8
title:	Siemens PLM Software TEAMCENTER Fixes for cross-site scripting vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=84004	Trust: 0.6

sources: JVNDB: JVNDB-2018-007765 // CNNVD: CNNVD-201807-465

EXTERNAL IDS

db:	NVD	id:	CVE-2018-11450	Trust: 2.5
db:	JVNDB	id:	JVNDB-2018-007765	Trust: 0.8
db:	CNNVD	id:	CNNVD-201807-465	Trust: 0.7
db:	VULHUB	id:	VH-CVE-2018-11450	Trust: 0.1

sources: VULHUB: VH-CVE-2018-11450 // JVNDB: JVNDB-2018-007765 // CNNVD: CNNVD-201807-465 // NVD: CVE-2018-11450

REFERENCES

url:	https://github.com/lucvandonk/siemens-siemens-plm-software-teamcenter-reflected-cross-site-scripting-xss-vulnerability/wiki	Trust: 2.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-11450	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2018-11450	Trust: 0.8

sources: JVNDB: JVNDB-2018-007765 // CNNVD: CNNVD-201807-465 // NVD: CVE-2018-11450

SOURCES

db:	VULHUB	id:	VH-CVE-2018-11450
db:	JVNDB	id:	JVNDB-2018-007765
db:	CNNVD	id:	CNNVD-201807-465
db:	NVD	id:	CVE-2018-11450

LAST UPDATE DATE

2022-05-04T10:15:52.557000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VH-CVE-2018-11450	date:	2020-11-03T00:00:00
db:	JVNDB	id:	JVNDB-2018-007765	date:	2018-09-26T00:00:00
db:	CNNVD	id:	CNNVD-201807-465	date:	2019-10-17T00:00:00
db:	NVD	id:	CVE-2018-11450	date:	2019-10-09T23:33:00

SOURCES RELEASE DATE

db:	VULHUB	id:	VH-CVE-2018-11450	date:	2018-05-25T00:00:00
db:	JVNDB	id:	JVNDB-2018-007765	date:	2018-09-26T00:00:00
db:	CNNVD	id:	CNNVD-201807-465	date:	2018-07-09T00:00:00
db:	NVD	id:	CVE-2018-11450	date:	2018-07-09T20:29:00