CVE-2024-23813 Missing authorization in Polarion ALM

What is CVE-2024-23813?

CVE-2024-23813 is a high-severity missing authorization vulnerability in Siemens Polarion ALM, published on 13 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability has been identified in Polarion ALM (All versions < V2404.0). The REST API endpoints of doorsconnector of the affected product lacks proper authentication. An unauthenticated attacker could access the endpoints, and potentially execute code.

Weakness: CWE-287

Which versions are affected by CVE-2024-23813?

It affects 1 product.

Products include Siemens Polarion Alm.

How do I fix CVE-2024-23813?

No fix has been published for CVE-2024-23813 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-23813 being exploited?

There is no known exploitation of CVE-2024-23813 in the wild and no public exploit code.

Other vulnerabilities in Siemens Polarion ALM

• CVE-2023-50236 Privilege escalation in Polarion ALM High 7.8
• CVE-2024-51444 SQL injection in Polarion V2310 High 7.1
• CVE-2024-51445 XML external entity in Polarion V2310 High 7.1
• CVE-2024-51447 Information disclosure in Polarion V2310 Medium 6.9
• CVE-2021-44478 Cross-site scripting in Polarion ALM Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-f8v6-h8xc-6v8q.