Siemens Polarion ALM
Polarion ALM contains a misconfiguration in its default Apache HTTP Server configuration that could allow an attacker to perform host header injection attacks. Siemens has released an update for Polarion ALM and recommends to update to the latest version.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-46265US | — | — | ||
A vulnerability has been identified in Polarion ALM (All versions < V2304.0). The affected application contains a Host header injection vulnerability that could allow an attacker t… | ||||
references
External citations — patches, advisories, analysis.
- SSA-792594: Host Header Injection Vulnerability in Polarion ALM - CSAF Versionself
- SSA-792594: Host Header Injection Vulnerability in Polarion ALM - HTML Versionself
- SSA-792594: Host Header Injection Vulnerability in Polarion ALM - PDF Versionself
- SSA-792594: Host Header Injection Vulnerability in Polarion ALM - TXT Versionself
- ICS Advisory ICSA-22-349-08 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-22-349-08 - Web Versionself
- Recommended Practicesexternal
remediations (2)
- MitigationPolarion ALM
In the product's Apache HTTP Server configuration, check polarion.conf or polarion-cluster.conf for the below misconfiguration: RedirectMatch permanent ^/$ /polarion/ which must be changed to RedirectMatch permanent "^/$" "https://<their-polarion-host-here>/polarion/"
- FixedPolarion ALM
Update to V2304.0 or later version
https://support.sw.siemens.com/
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan