Path traversal in Siemens Teamcenter Active Workspace V4.3
Priority LOW 25CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.
Summary
A vulnerability has been identified in Teamcenter Active Workspace V4.3 (All versions < V4.3.10), Teamcenter Active Workspace V5.0 (All versions < V5.0.8), Teamcenter Active Workspace V5.1 (All versions < V5.1.5), Teamcenter Active Workspace V5.2 (All versions < V5.2.1). A path traversal vulnerability in the application could allow an attacker to bypass certain restrictions such as direct access to other services within the host.
Why it matters now
EPSS 0.01167 67th percentileScored 2026-11-07
Fix Fixed Teamcenter Active Workspace V4.3 (Siemens): V4.3.10Teamcenter Active Workspace V5.0 (Siemens): V5.0.8+2 more products
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Siemens | Teamcenter Active Workspace V4.3 | before V4.3.10 | V4.3.10 | Patch available | CNA |
| Siemens | Teamcenter Active Workspace V5.0 | before V5.0.8 | V5.0.8 | Patch available | CNA |
| Siemens | Teamcenter Active Workspace V5.1 | before V5.1.5 | V5.1.5 | Patch available | CNA |
| Siemens | Teamcenter Active Workspace V5.2 | before V5.2.1 | V5.2.1 | Patch available | CNA |
- Teamcenter Active Workspace V4.3 VendorSiemens Affected before V4.3.10 Fixed in V4.3.10 Patch available CNA
- Teamcenter Active Workspace V5.0 VendorSiemens Affected before V5.0.8 Fixed in V5.0.8 Patch available CNA
- Teamcenter Active Workspace V5.1 VendorSiemens Affected before V5.1.5 Fixed in V5.1.5 Patch available CNA
- Teamcenter Active Workspace V5.2 VendorSiemens Affected before V5.2.1 Fixed in V5.2.1 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:siemens:teamcenter_active_workspace:*:*:*:*:*:*:*:* | 4.3.0 to before 4.3.10; 5.0.0 to before 5.0.8; 5.1.0 to before 5.1.5; 5.2.0 to before 5.2.1 | Vulnerable | Siemens |
- cpe:2.3:a:siemens:teamcenter_active_workspace:*:*:*:*:*:*:*:* Versions 4.3.0 to before 4.3.10; 5.0.0 to before 5.0.8; 5.1.0 to before 5.1.5; 5.2.0 to before 5.2.1 Vulnerable ·Siemens
Remediation
- Fix · CNA Teamcenter Active Workspace V4.3 (Siemens) Fixed in V4.3.10
- Fix · CNA Teamcenter Active Workspace V5.0 (Siemens) Fixed in V5.0.8
- Fix · CNA Teamcenter Active Workspace V5.1 (Siemens) Fixed in V5.1.5
- Fix · CNA Teamcenter Active Workspace V5.2 (Siemens) Fixed in V5.2.1
Timeline
- 2026-10-02 Threatist record created from CVE-2021-40357
- 2026-10-03 Alias added: GHSA-mpq8-w9f5-qm6g
References
More Siemens Teamcenter Active Workspace vulnerabilities
- TI-2021-18286 Path traversal in Siemens Teamcenter Active Workspace V4.3 CVSS 3.1HIGH 7.2
- TI-2022-13880 Cross-site scripting in Siemens Teamcenter Active Workspace V5.2 CVSS 3.1MEDIUM 6.1
- TI-2021-13084 Cross-site scripting in Siemens Teamcenter Active Workspace V4 CVSS 3.1MEDIUM 6.1
- TI-2021-13085 Information disclosure through error messages in Siemens Teamcenter Active Workspace V4 CVSS 3.1MEDIUM 5.3
- TI-2021-13083 Information disclosure in Siemens Teamcenter Active Workspace V4 CVSS 3.1MEDIUM 4.3
Sources
- CVE-2021-40357 · CVE Program
- CVE-2021-40357 · NVD
- FIRST EPSS
- GHSA-mpq8-w9f5-qm6g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences