PT-2025-20844 · Siemens · Polarion

Published 2025-05-13 · Updated 2025-05-13 · CVE-2024-51444

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: Polarion V2310 (All versions) Polarion V2404 versions prior to V2404.4

Description: The application insufficiently validates user input for database read queries, which could allow an authenticated remote attacker to conduct an SQL injection attack. This attack can bypass authorization controls and enable the download of any data from the application's database.

Recommendations: For Polarion V2310, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Polarion V2404 versions prior to V2404.4, update to version V2404.4 or later to resolve the issue.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2025-06646

CVE-2024-51444

Affected Products

Polarion

References · 6

• https://cert-portal.siemens.com/productcert/html/ssa-162255.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-51444 · Security Note
• https://osv.dev/vulnerability/CVE-2024-51444 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-06646 · Security Note
• https://twitter.com/VulmonFeeds/status/1922357220714356828 · Twitter Post
• https://twitter.com/CVEnew/status/1922228949003698615 · Twitter Post