Siemens Polarion ALM
Polarion ALM is affected by incorrect default path permissions in installation path, and improper authentication in the REST API endpoints of DOORS connector. An attacker could exploit the vulnerabilities for unauthenticated access, or privilege escalation. Siemens has released a new version for Polarion ALM and recommends to update to the latest version.
beschreibt (2)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-23813US | critical9.8 | — | ||
A vulnerability has been identified in Polarion ALM (All versions < V2404.0). The REST API endpoints of doorsconnector of the affected product lacks proper authentication. An unaut… | ||||
| CVE-2023-50236US | high7.8OT erhöht | — | ||
A vulnerability has been identified in Polarion ALM (All versions < V2404.0). The affected product is vulnerable due to weak file and folder permissions in the installation path. A… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-871717: Multiple Vulnerabilities in Polarion ALM - CSAF Versionself
- SSA-871717: Multiple Vulnerabilities in Polarion ALM - HTML Versionself
- SSA-871717: Multiple Vulnerabilities in Polarion ALM - PDF Versionself
- SSA-871717: Multiple Vulnerabilities in Polarion ALM - TXT Versionself
- ICS Advisory ICSA-24-046-14 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-24-046-14 - Web Versionself
- Recommended Practicesexternal
Behebungen (4)
- MitigationPolarion ALM
If DOORS connector is not used in the environment, it is advised to limit unauthenticated access within the Apache configuration. For further details, please refer to the Additional Information section.
- MitigationPolarion ALM
In Polarion Windows installation, restrict permissions of BUILTIN\Users from accessing the entire Polarion installation folders to prevent data corruption. Please refer to the Additional Information section for further details.
- BehobenPolarion ALM
Update to V2404.0 or later version
- BehobenPolarion ALM
Update to V2404.0 or later version
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan