XML External Entity Injection Vulnerability in Polarion ALM by Siemens

CVE-2023-28828

What is CVE-2023-28828?

A vulnerability exists in Polarion ALM, where improper handling of XML input allows an attacker to leverage an XML External Entity Injection (XXE) exploit. This vulnerability could enable unauthorized access to sensitive files on the application server's filesystem, potentially leading to data exposure and subsequent misuse. Organizations using affected versions of Polarion ALM should prioritize addressing this flaw to maintain security and operational integrity.

References