Siemens Polarion ALM
view advisory published 2024-05-14
The Apache Lucene based query engine in Polarion ALM lacks proper access controls. This could allow an authenticated user to query items beyond the user's allowed projects. Siemens has released a new version for Polarion ALM and recommends to update to the latest version.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-33647US | — | — | ||
A vulnerability has been identified in Polarion ALM (All versions < V2404.0). The Apache Lucene based query engine in the affected application lacks proper access controls. This co… | ||||
02
references
External citations — patches, advisories, analysis.
- SSA-925850: Improper Access Control in Polarion ALM - CSAF Versionself
- SSA-925850: Improper Access Control in Polarion ALM - HTML Versionself
- SSA-925850: Improper Access Control in Polarion ALM - PDF Versionself
- SSA-925850: Improper Access Control in Polarion ALM - TXT Versionself
- ICS Advisory ICSA-24-137-04 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-24-137-04 - Web Versionself
- Recommended Practicesexternal
03
remediations (1)
- FixedPolarion ALM
Update to V2404.0 or later version
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan