Description
A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.4). The application insufficiently validates user input for database read queries. This could allow an authenticated remote attacker to conduct an SQL injection attack that bypasses authorization controls and allows to download any data from the application's database.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Siemens | Polarion V2310 | — | — |
| Siemens | Polarion V2404 | < V2404.4 | V2404.4 |
Advisories 3
- NCSC-2025-0160 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · May 14, 2025
- ICSA-25-135-11 Siemens Polarion CISA ICS & IT advisories · May 13, 2025
- SSA-162255 SSA-162255: Multiple Vulnerabilities in Polarion Before V2410 Siemens ProductCERT · May 13, 2025