Summary
The Apache Lucene based query engine in Polarion ALM lacks proper access controls. This could allow an authenticated user to query items beyond the user's allowed projects.
Siemens has released a new version for Polarion ALM and recommends to update to the latest version.
Vulnerabilities 1
-
Medium 6.5
A vulnerability has been identified in Polarion ALM (All versions < V2404.0). The Apache Lucene based query engine in t…
Revision history
-
#1
Publication Date
References
-
SSA-925850: Improper Access Control in Polarion ALM - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-925850.html
-
SSA-925850: Improper Access Control in Polarion ALM - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-925850.pdf
-
SSA-925850: Improper Access Control in Polarion ALM - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-925850.txt
-
ICS Advisory ICSA-24-137-04 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-24-137-04
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B