Description
A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.4). The affected application contains a XML External Entity Injection (XXE) vulnerability in the docx import feature. This could allow an authenticated remote attacker to read arbitrary data from the application server.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Siemens | Polarion V2310 | — | — |
| Siemens | Polarion V2404 | < V2404.4 | V2404.4 |
Advisories 3
- NCSC-2025-0160 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · May 14, 2025
- ICSA-25-135-11 Siemens Polarion CISA ICS & IT advisories · May 13, 2025
- SSA-162255 SSA-162255: Multiple Vulnerabilities in Polarion Before V2410 Siemens ProductCERT · May 13, 2025