Affected Version<\/strong>: 2312.8
Vulnerability Type<\/strong>: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
Security Risk<\/strong>: HIGH
Vendor<\/strong>: Siemens
Vendor URL<\/strong>: https:\/\/plm.sw.siemens.com\/en-US\/teamcenter\/<\/a>
Vendor acknowledged vulnerability<\/strong>: Yes
Vendor Status<\/strong>: Fixed<\/a>
CVE Number<\/strong>: CVE-2026-33862<\/a>
CVE Link<\/strong>: https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-33862<\/a>
Advisory ID<\/strong>: usd-2025-38<\/p>\n
Description<\/h3>\n
The application does not properly encode or filter user-supplied data, which allows injection of stored JavaScript code.<\/p>\n
The victim's browser will execute this code when they visit the site.<\/p>\n
An XSS vulnerability can be exploited in various ways.
A common attack is to steal sensitive information from the user and secretly transmit it to the attackers.
Alternatively, attackers can perform actions with the rights of the user.<\/p>\n
Proof of Concept<\/h3>\n
It was possible to attach files to objects, which had an XSS payload in their filename. When the overview of attachments was opened, the XSS payload would be executed.<\/p>\n
First, a new object was created with a low privileged user. Once created, the attachments of the created object can be opened and a new attachment uploaded. After uploading the malicious attachment, the payload triggers whenever the References<\/strong> column is shown in the application:<\/p>\n If the malicious attachment was uploaded to the object, the payload triggers every time a user inspects the table view that includes the References<\/strong> column. It is recommended to treat all input on the website as potentially dangerous.<\/p>\n Invalid values should not be sanitized and passed to the application, but instead be rejected. Additionally, all output that is dynamically generated based on user-controlled data should be encoded according to its context. If the application requires users, for example, to be able to change text in an editor using HTML this type of output encoding is not possible without breaking this functionality. Further details on how to prevent XSS vulnerabilities can be obtained in the XSS Prevention Cheat Sheet by OWASP.<\/p>\n This security vulnerability was identified by Dustin Born of usd AG.<\/p>\n [\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":" usd-2025-38 | Teamcenter 2312.8 - Cross-Site Scripting Product: TeamcenterAffected Version: 2312.8Vulnerability Type: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)Security Risk: HIGHVendor: SiemensVendor URL: https:\/\/plm.sw.siemens.com\/en-US\/teamcenter\/Vendor acknowledged vulnerability: YesVendor Status: FixedCVE Number: CVE-2026-33862CVE Link: https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-33862Advisory ID: usd-2025-38 Description The application does not properly encode or filter user-supplied data, which allows injection of stored […]<\/p>\n","protected":false},"author":114,"featured_media":0,"parent":16124,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"class_list":["post-25287","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/25287","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/users\/114"}],"replies":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/comments?post=25287"}],"version-history":[{"count":2,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/25287\/revisions"}],"predecessor-version":[{"id":25290,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/25287\/revisions\/25290"}],"up":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16124"}],"wp:attachment":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/media?parent=25287"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
In this case, the object type was Item Revision<\/strong>.
To make the payload trigger, the Files view has to be in Table<\/strong> mode.
In this case the filename is reflected in the Column References<\/strong>:<\/p>\n![\"\"](\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2026\/07\/view_mode_table.png\")
<\/p>\n
Here, a PDF file named \"><img onerror=\"alert(document.domain)\" src=\"x\"\/>.pdf<\/strong> was attached to the object:<\/p>\n![\"\"](\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2026\/07\/xss_upload.png\")
<\/p>\n![\"\"](\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2026\/07\/xss_triggered.png\")
<\/p>\n
Attackers can thus execute arbitrary JavaScript code in their name and potentially steal sensitive information or even the user session.<\/p>\nFix<\/h3>\n
To achieve this, all input should be validated on the server-side.
Where possible, a list of allowed characters should be defined.
The more restrictive a filter can be specified, the better the protection it provides.
Allowlists are especially recommended if input values have a well defined format or a list of valid input values exists.<\/p>\n
The majority of programming languages support standard procedures for encoding meta characters.
For example, PHP has the built-in function htmlspecialchars()<\/em>.<\/p>\n
In such cases, the use of client-side HTML sanitization is recommended.<\/p>\nReferences<\/h3>\n
\n
Timeline<\/h3>\n
\n
Credits<\/h3>\n