Siemens Polarion Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Siemens Polarion versions 2404 (prior to 2404.5) and 2410 (prior to 2410.2). The issue arises because the application allows arbitrary JavaScript to be included in document titles. An authenticated remote attacker could exploit this by creating specially crafted document titles that, when viewed by other users, execute the embedded JavaScript.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected JavaScript is executed in the context of the user viewing the document.

Remediation

Users are advised to update to Polarion version 2404.5 or later, or version 2410.2 or later. Additional information can be found on the Siemens support website.