PT-2025-20847 · Unknown · Polarion V2404+1

Published 2025-05-13 · Updated 2025-05-13 · CVE-2024-51447

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: Polarion V2310 (All versions) Polarion V2404 versions prior to V2404.2

Description: A vulnerability has been identified in the login implementation of the affected application, which contains an observable response discrepancy when validating usernames. This could allow an unauthenticated remote attacker to distinguish between valid and invalid usernames.

Recommendations: For Polarion V2310, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Polarion V2404 versions prior to V2404.2, update to version V2404.2 or later to resolve the issue.

Weakness Enumeration

CWE-204

Related Identifiers

BDU:2025-06647

CVE-2024-51447

Affected Products

Polarion V2310

Polarion V2404

References · 5

• https://cert-portal.siemens.com/productcert/html/ssa-162255.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-51447 · Security Note
• https://bdu.fstec.ru/vul/2025-06647 · Security Note
• https://osv.dev/vulnerability/CVE-2024-51447 · Vendor Advisory
• https://twitter.com/CVEnew/status/1922228946252304629 · Twitter Post