Polarion ALM vulnerabilities

3 known vulnerabilities in Polarion ALM from Siemens. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Polarion ALM: Improper Authentication

  CVE-2024-23813Feb 13, 2024Siemens

  A vulnerability has been identified in Polarion ALM (All versions < V2404.0). The REST API endpoints of doorsconnector of the affected product lacks proper authentication. An unauthenticated attacker could access the endpoints, and potentially execute code.

• 7.8 High severity

  Polarion ALM: Incorrect Default Permissions

  CVE-2023-50236Feb 13, 2024Siemens

  A vulnerability has been identified in Polarion ALM (All versions < V2404.0). The affected product is vulnerable due to weak file and folder permissions in the installation path. An attacker with local access could exploit this vulnerability to escalate privil

• 7.5 High severity

  Polarion ALM: Improper Restriction of XML External Entity Reference

  CVE-2023-28828Apr 11, 2023Siemens

  A vulnerability has been identified in Polarion ALM (All versions < V22R2). The application contains a XML External Entity Injection (XXE) vulnerability. This could allow an attacker to view files on the application server filesystem.