PT-2022-12127 · Siemens · Polarion Alm+1

Published 2022-03-08 · Updated 2022-07-28 · CVE-2021-44478

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Polarion ALM versions prior to V21 R2 P2 Polarion WebClient for SVN (all versions)

Description A cross-site scripting issue is present due to improper neutralization of data sent to the web page through the SVN WebClient in the affected product. This could allow an attacker to execute arbitrary code and extract sensitive information by sending a specially crafted link to users with administrator privileges.

Recommendations For Polarion ALM versions prior to V21 R2 P2, update to version V21 R2 P2 or later to resolve the issue. For Polarion WebClient for SVN, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-44478

Affected Products

Polarion Alm

Polarion Webclient For Svn

References · 3

• https://cert-portal.siemens.com/productcert/pdf/ssa-562051.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44478 · Security Note
• https://osv.dev/vulnerability/CVE-2021-44478 · Vendor Advisory