CVE-2024-51445
MEDIUMPolarion ALM V2310 and V2404 < V2404.4 - Authenticated XML External Entity Injection in Docx Import Feature
Title source: llmDescription
A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.4). The affected application contains a XML External Entity Injection (XXE) vulnerability in the docx import feature. This could allow an authenticated remote attacker to read arbitrary data from the application server.
References (1)
Core 1
Core References
Vendor Advisory
https://cert-portal.siemens.com/productcert/html/ssa-162255.html
Scores
CVSS v3
6.5
EPSS
0.0045
EPSS Percentile
35.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-611
Status
published
Products (2)
siemens/polarion_alm
2310.0
siemens/polarion_alm
2404.0 - 2404.4
Published
May 13, 2025
Tracked Since
Feb 18, 2026