Medium SSA-632164 1 CVE

SSA-632164: External Entity Injection Vulnerability in Polarion ALM

Published Apr 11, 2023 · Updated May 9, 2023 · Revision 2

Vendor: Siemens Product: Polarion ALM

Summary

Polarion ALM is vulnerable to XML External Entity (XXE) injection attack that could allow an attacker to potentially disclose confidential data.

Siemens has released an update for Polarion ALM and recommends to update to the latest version.

Vulnerabilities 1

Medium 5.9

CVE-2023-28828

A vulnerability has been identified in Polarion ALM (All versions < V22R2). The application contains a XML External Ent…

Siemens Polarion ALM ICS / OT

Apr 11, 2023

Revision history

2023-05-09 #2
Corrected fix version to an earlier release of Polarion ALM that fixes the vulnerability; Updated CVSS rating of CVE-2023-28828
2023-04-11 #1
Publication Date

References

SSA-632164: External Entity Injection Vulnerability in Polarion ALM - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-632164.html
SSA-632164: External Entity Injection Vulnerability in Polarion ALM - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-632164.pdf
SSA-632164: External Entity Injection Vulnerability in Polarion ALM - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-632164.txt