SSA-792594: Host Header Injection Vulnerability in Polarion ALM
Polarion ALM contains a misconfiguration in its default Apache HTTP Server configuration that could allow an attacker to perform host header injection attacks. Siemens has released an update for Polarion ALM and recommends to update to the latest version.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-46265US | — | — | ||
A vulnerability has been identified in Polarion ALM (All versions < V2304.0). The affected application contains a Host header injection vulnerability that could allow an attacker t… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-792594: Host Header Injection Vulnerability in Polarion ALM - CSAF Versionself
- SSA-792594: Host Header Injection Vulnerability in Polarion ALM - HTML Versionself
- SSA-792594: Host Header Injection Vulnerability in Polarion ALM - PDF Versionself
- SSA-792594: Host Header Injection Vulnerability in Polarion ALM - TXT Versionself
Behebungen (2)
- MitigationPolarion ALM
In the product's Apache HTTP Server configuration, check polarion.conf or polarion-cluster.conf for the below misconfiguration: RedirectMatch permanent ^/$ /polarion/ which must be changed to RedirectMatch permanent "^/$" "https://<their-polarion-host-here>/polarion/"
- BehobenPolarion ALM
Update to V2304.0 or later version
https://support.sw.siemens.com/
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan