Siemens Polarion ALM
Advisory ansehen veröffentlicht 2024-05-14
The Apache Lucene based query engine in Polarion ALM lacks proper access controls. This could allow an authenticated user to query items beyond the user's allowed projects. Siemens has released a new version for Polarion ALM and recommends to update to the latest version.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-33647US | — | — | ||
A vulnerability has been identified in Polarion ALM (All versions < V2404.0). The Apache Lucene based query engine in the affected application lacks proper access controls. This co… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-925850: Improper Access Control in Polarion ALM - CSAF Versionself
- SSA-925850: Improper Access Control in Polarion ALM - HTML Versionself
- SSA-925850: Improper Access Control in Polarion ALM - PDF Versionself
- SSA-925850: Improper Access Control in Polarion ALM - TXT Versionself
- ICS Advisory ICSA-24-137-04 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-24-137-04 - Web Versionself
- Recommended Practicesexternal
03
Behebungen (1)
- BehobenPolarion ALM
Update to V2404.0 or later version
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan