ICSA-23-103-12

icsaUScisa_csaf_ot

Siemens Polarion ALM

view advisory published 2023-04-11

Polarion ALM is vulnerable to XML External Entity (XXE) injection attack that could allow an attacker to potentially disclose confidential data. Siemens has released an update for Polarion ALM and recommends to update to the latest version.

01

describes (1)

Related CVEs.

IDseverity exploitable
CVE-2023-28828US——
A vulnerability has been identified in Polarion ALM (All versions < V22R2). The application contains a XML External Entity Injection (XXE) vulnerability. This could allow an attack…
02

references

External citations — patches, advisories, analysis.

03

remediations (2)

  • MitigationPolarion ALM

    Set the below configurations to mitigate against external entity injection in OpenSAML 4.x parser configuration. This will be included by default on Polarion V2304 and later versions. parserPool.setMaxPoolSize(100); parserPool.setCoalescing(true); parserPool.setIgnoreComments(true); parserPool.setIgnoreElementContentWhitespace(true); parserPool.setNamespaceAware(true); parserPool.setExpandEntityReferences(false); parserPool.setXincludeAware(false); final Map&lt;String, Boolean&gt; features = new HashMap&lt;String, Boolean&gt;(); features.put(http://xml.org/sax/features/external-general-entities, Boolean.FALSE); features.put(http://xml.org/sax/features/external-parameter-entities, Boolean.FALSE); features.put(http://apache.org/xml/features/disallow-doctype-decl, Boolean.TRUE); features.put(http://apache.org/xml/features/validation/schema/normalized-value, Boolean.FALSE); features.put(http://javax.xml.XMLConstants/feature/secure-processing, Boolean.TRUE); parserPool.setBuilderFeatures(features);

  • FixedPolarion ALM

    Update to V22R2 or later version

    https://support.sw.siemens.com/
scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan