Siemens Polarion Stored Cross-Site Scripting Vulnerability via Improperly Sanitized XML File Upload

A stored cross-site scripting vulnerability has been identified in Siemens Polarion versions prior to V2410 and in V2404 versions earlier than V2404.4. The issue arises because the file upload feature does not properly sanitize XML files, allowing authenticated remote attackers to upload specially crafted XML files. These files can later be downloaded and viewed by other users, potentially executing malicious scripts in their browsers.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where uploaded XML files containing malicious scripts are executed in the context of the user viewing the file.

Remediation

Users are advised to update Polarion to V2410 or later. For Polarion V2404, patch releases can be applied.