Siemens Polarion SQL Injection Vulnerability Allowing Unauthorized Data Access

A SQL injection vulnerability has been identified in Siemens Polarion versions prior to V2410 and in V2404 versions earlier than V2404.4. The issue arises because the application fails to properly validate user input for database read queries. This flaw could enable an authenticated remote attacker to bypass authorization controls and download any data from the application's database.

Impact

Exploitation of this vulnerability could lead to unauthorized access to the application's database, allowing attackers to download sensitive data.

Remediation

Siemens recommends updating Polarion to V2410 or later. For Polarion V2404, patch releases can be applied.