Medium severity · published Jan 12, 2021
CVE-2020-26981
A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0)
6.5
CVSS
2.6%
EPSS
No
On KEV
Description
A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). When opening a specially crafted xml file, the application could disclose arbitrary files to remote attackers. This is because of the passing of specially crafted content to the underlying XML parser without taking proper restrictions such as prohibiting an external dtd. (ZDI-CAN-11890)
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.6% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JT
Jt2go · Siemens
before 13.1.0 · source: NVD
TV
Teamcenter Visualization · Siemens
before 13.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-26981
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-26981
Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-622830.pdf
Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-048/
More from Jt2go
8.8
CVE-2020-26996
A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0)
8.8
CVE-2020-26995
A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0)
8.8
CVE-2020-26994
A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0)
8.8
CVE-2020-26991
A vulnerability has been identified in JT2Go (All versions < V13.1.0.2), Teamcenter Visualization (All versions < V13.1.0.2)
8.8
CVE-2020-26990
A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Teamcenter Visualization (All versions < V13.1.0.1)