Summary
Polarion ALM contains a misconfiguration in its default Apache HTTP Server configuration that could allow an attacker to perform host header injection attacks.
Siemens has released an update for Polarion ALM and recommends to update to the latest version.
Vulnerabilities 1
-
Medium 5.4
A vulnerability has been identified in Polarion ALM (All versions < V2304.0). The affected application contains a Host …
Revision history
-
#3
Revision - Fixing typos
-
#2
Added fix for Polarion ALM
-
#1
Publication Date
References
-
SSA-792594: Host Header Injection Vulnerability in Polarion ALM - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-792594.html
-
SSA-792594: Host Header Injection Vulnerability in Polarion ALM - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-792594.pdf
-
SSA-792594: Host Header Injection Vulnerability in Polarion ALM - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-792594.txt
-
ICS Advisory ICSA-22-349-08 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-22-349-08
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B