PT-2025-20846 · Siemens · Polarion V2404+1

Published 2025-05-13 · Updated 2025-05-13 · CVE-2024-51446

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Polarion V2310 (All versions) Polarion V2404 versions prior to V2404.4

Description: A vulnerability has been identified in the file upload feature of the affected application, which improperly sanitizes xml files. This could allow an authenticated remote attacker to conduct a stored cross-site scripting attack by uploading specially crafted xml files that are later downloaded and viewed by other users of the application.

Recommendations: For Polarion V2310, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Polarion V2404 versions prior to V2404.4, update to version V2404.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the file upload feature to minimize the risk of exploitation.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-06645

CVE-2024-51446

Affected Products

Polarion V2310

Polarion V2404

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-51446 · Security Note
• https://cert-portal.siemens.com/productcert/html/ssa-162255.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-06645 · Security Note
• https://osv.dev/vulnerability/CVE-2024-51446 · Vendor Advisory
• https://twitter.com/CVEnew/status/1922228947116298255 · Twitter Post