Unauthorized Access to Project Data in Polarion ALM Due to Lack of Access Controls
CVE-2024-33647

6.5MEDIUM

Key Information:

Vendor
Siemens
Status
Polarion Alm
Vendor
CVE Published:
14 May 2024

Summary

A vulnerability has been identified in Polarion ALM (All versions < V2404.0). The Apache Lucene based query engine in the affected application lacks proper access controls. This could allow an authenticated user to query items beyond the user's allowed projects.

Affected Version(s)

Polarion ALM 0

References

https://cert-portal.siemens.com/productcert/html/ssa-9258...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.