As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens’ ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
1. EXECUTIVE SUMMARY
- CVSS v4 7.1
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: Polarion ALM
- Vulnerability: Improper Access Control
2. RISK EVALUATION
Successful exploitation of this vulnerability could allow an authenticated user to query items beyond the user’s allowed projects.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
The following versions of Siemens Polarion ALM, an application lifecycle management software, are affected:
- Polarion ALM: All versions prior to V2404.0
3.2 Vulnerability Overview
3.2.1 IMPROPER ACCESS CONTROL CWE-284
The Apache Lucene based query engine in the affected application lacks proper access controls. This could allow an authenticated user to query items beyond the user’s allowed projects.
CVE-2024-33647 has been assigned to this vulnerability. A CVSS v3.1 base score of 6.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
A CVSS v4 score has also been calculated for CVE-2024-33647. A
[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.
Read the original article: