Description
A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.4). The file upload feature of the affected application improperly sanitizes xml files. This could allow an authenticated remote attacker to conduct a stored cross-site scripting attack by uploading specially crafted xml files that are later downloaded and viewed by other users of the application.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Siemens | Polarion V2310 | — | — |
| Siemens | Polarion V2404 | < V2404.4 | V2404.4 |
Advisories 3
- NCSC-2025-0160 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · May 14, 2025
- ICSA-25-135-11 Siemens Polarion CISA ICS & IT advisories · May 13, 2025
- SSA-162255 SSA-162255: Multiple Vulnerabilities in Polarion Before V2410 Siemens ProductCERT · May 13, 2025