XML External Entity Injection Vulnerability in Polarion by Siemens
CVE-2024-51445

7.1HIGH

Key Information:

Vendor

Siemens
Status
Polarion V2310
Polarion V2404
Vendor
CVE Published:
13 May 2025

What is CVE-2024-51445?

A vulnerability in Polarion applications allows attackers with authentication to exploit the docx import feature through XML External Entity Injection. This flaw enables them to potentially read sensitive data from the application server, posing a risk to data confidentiality and integrity.

Affected Version(s)

Polarion V2310 0

Polarion V2404 0

References

https://cert-portal.siemens.com/productcert/html/ssa-1622...

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2024-51445 : XML External Entity Injection Vulnerability in Polarion by Siemens