Siemens Polarion Observable Response Discrepancy Vulnerability in Username Validation

A vulnerability exists in Siemens Polarion versions prior to 2410 and in all versions of Polarion V2404 prior to V2404.2. The issue arises from the login implementation, which exhibits an observable response discrepancy when validating usernames. This vulnerability could enable an unauthenticated remote attacker to differentiate between valid and invalid usernames.

Impact

Exploitation of this vulnerability allows for username enumeration, where an attacker can identify valid usernames within the application.

Remediation

Users are advised to update Polarion to version 2410 or later. For Polarion V2404, patch releases are available.