title: PTC Codebeamer Cross site scripting
description:
​If an attacker tricks an admin user of PTC Codebeamer into clicking on a malicious link, it may allow the attacker to inject arbitrary code to be executed in the browser on the target device.
problem types: CWE-79 Cross-site Scripting
affected:
{
defaultStatus: unaffected
product: Codebeamer
vendor: PTC
versions:
lessThanOrEqual: v22.10-SP7, status: affected, version: 0, versionType: custom
lessThanOrEqual: v22.04-SP5, status: affected, version: 0, versionType: custom
lessThanOrEqual: v21.09-SP13, status: affected, version: 0, versionType: custom
status: unaffected, version: 2.0
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions:
PTC recommends the following:
*  ​Version 22.10.X:  upgrade to 22.10-SP8 https://intland.com/codebeamer-download/  or newer version
*  ​Version 22.04.X:  upgrade to 22.04-SP6 https://intland.com/codebeamer-download/  or newer version
*  ​Version 21.09.X:  upgrade to 21.09-SP14 https://intland.com/codebeamer-download/  or newer version
​Docker Image download:  https://hub.docker.com/r/intland/codebeamer/tags https://hub.docker.com/r/intland/codebeamer/tags
​Codebeamer installers:  https://intland.com/codebeamer-download/ https://intland.com/codebeamer-download/
​Hosted customers may  request an upgrade through the support channel https://codebeamer.com/cb/tracker/1910563 .
​Note that version 2.0 is not impacted by this vulnerability.
​For more information refer to  PTC Security Advisory and Resolution https://codebeamer.com/cb/wiki/31346480 .