{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Simcenter STAR-CCM+ contains an information disclosure vulnerability when using the Power-on-Demand public license server. An attacker could access a system\u0027s host, user, and display name.\n\nSiemens has updated the public Power-on-Demand public license server.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "productcert@siemens.com",
      "name": "Siemens ProductCERT",
      "namespace": "https://www.siemens.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-555707: Information Disclosure Vulnerability in Simcenter STAR-CCM+ - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-555707.html"
      },
      {
        "category": "self",
        "summary": "SSA-555707: Information Disclosure Vulnerability in Simcenter STAR-CCM+ - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-555707.json"
      }
    ],
    "title": "SSA-555707: Information Disclosure Vulnerability in Simcenter STAR-CCM+",
    "tracking": {
      "current_release_date": "2026-07-14T00:00:00.000Z",
      "generator": {
        "engine": {
          "name": "Siemens ProductCERT CSAF Generator",
          "version": "1"
        }
      },
      "id": "SSA-555707",
      "initial_release_date": "2022-08-09T00:00:00.000Z",
      "revision_history": [
        {
          "date": "2022-08-09T00:00:00.000Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        },
        {
          "date": "2026-07-14T00:00:00.000Z",
          "legacy_version": "1.1",
          "number": "2",
          "summary": "Added fix for Simcenter STAR-CCM+"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Simcenter STAR-CCM+ only if the Power-on-Demand public license server is used",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "Simcenter STAR-CCM+"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-34659",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "notes": [
        {
          "category": "description",
          "text": "Affected applications expose user, host and display name of users, when the public license server is used. This could allow an attacker to retrieve this information.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Avoid using sensitive or personal data in user, host and display names",
          "product_ids": [
            "1"
          ]
        },
        {
          "category": "mitigation",
          "details": "Set the environmental variable STARLICENSEHIDE to 1. This will send the string \"unknown\" for the user, host and display name instead of the real values. The setting is  supported since version V8.04 (June 2013) of Simcenter STAR-CCM+",
          "product_ids": [
            "1"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vulnerability fixed with update of Power-on-Demand public license server on 2026-06-24; no user actions necessary",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2022-34659"
    }
  ]
}