Siemens Polarion ALM
Polarion ALM is affected by incorrect default path permissions in installation path, and improper authentication in the REST API endpoints of DOORS connector. An attacker could exploit the vulnerabilities for unauthenticated access, or privilege escalation. Siemens has released a new version for Polarion ALM and recommends to update to the latest version.
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-23813US | critical9.8 | — | ||
A vulnerability has been identified in Polarion ALM (All versions < V2404.0). The REST API endpoints of doorsconnector of the affected product lacks proper authentication. An unaut… | ||||
| CVE-2023-50236US | high7.8OT elevated | — | ||
A vulnerability has been identified in Polarion ALM (All versions < V2404.0). The affected product is vulnerable due to weak file and folder permissions in the installation path. A… | ||||
references
External citations — patches, advisories, analysis.
- SSA-871717: Multiple Vulnerabilities in Polarion ALM - CSAF Versionself
- SSA-871717: Multiple Vulnerabilities in Polarion ALM - HTML Versionself
- SSA-871717: Multiple Vulnerabilities in Polarion ALM - PDF Versionself
- SSA-871717: Multiple Vulnerabilities in Polarion ALM - TXT Versionself
- ICS Advisory ICSA-24-046-14 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-24-046-14 - Web Versionself
- Recommended Practicesexternal
remediations (4)
- MitigationPolarion ALM
If DOORS connector is not used in the environment, it is advised to limit unauthenticated access within the Apache configuration. For further details, please refer to the Additional Information section.
- MitigationPolarion ALM
In Polarion Windows installation, restrict permissions of BUILTIN\Users from accessing the entire Polarion installation folders to prevent data corruption. Please refer to the Additional Information section for further details.
- FixedPolarion ALM
Update to V2404.0 or later version
- FixedPolarion ALM
Update to V2404.0 or later version
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan