Summary
The Subversion Webclient in Polarion ALM contains a cross-site scripting vulnerability, that could be triggered by an attacker by sending crafted links to an administrator user of Polarion ALM.
Siemens has released an update for the Subversion Webclient in Polarion ALM and recommends to update to the latest version.
Vulnerabilities 1
-
Unscored —
A vulnerability has been identified in Polarion ALM (All versions < V21 R2 P2), Polarion WebClient for SVN (All version…
Revision history
-
#3
Revision - Fixing typos
-
#2
Corrected list of affected versions; clarified difference between Polarion ALM and the freeware (WebClient for SVN)
-
#1
Publication Date
References
-
SSA-562051: Cross-Site Scripting Vulnerability in Polarion ALM - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-562051.txt
-
SSA-562051: Cross-Site Scripting Vulnerability in Polarion ALM - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-562051.pdf
-
ICS Advisory ICSA-22-069-08 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-22-069-08
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B