OpenCVE

A vulnerability has been identified in Polarion ALM (All versions < V2404.0). The REST API endpoints of doorsconnector of the affected product lacks proper authentication. An unauthenticated attacker could access the endpoints, and potentially execute code.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Siemens	Polarion Alm

Configuration 1 [-]

cpe:2.3:a:siemens:polarion_alm:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://cert-portal.siemens.com/productcert/html/ssa-871717.html

History

Fri, 04 Oct 2024 17:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Siemens Siemens polarion Alm
CPEs		cpe:2.3:a:siemens:polarion_alm::::::::
Vendors & Products		Siemens Siemens polarion Alm

MITRE

Status: PUBLISHED

Assigner: siemens

Published: 2024-02-13T09:00:25.915Z

Updated: 2024-08-01T23:13:08.420Z

Reserved: 2024-01-22T17:44:56.763Z

Link: CVE-2024-23813

Vulnrichment

No data.

NVD

Status : Modified

Published: 2024-02-13T09:15:50.140

Modified: 2024-11-21T08:58:28.663

Link: CVE-2024-23813

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:siemens:polarion_alm:*:*:*:*:*:*:*:*", "matchCriteriaId": "00E023E4-0221-4342-8EE3-9D6CA296BE82", "versionEndExcluding": "2404.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in Polarion ALM (All versions < V2404.0). The REST API endpoints of doorsconnector of the affected product lacks proper authentication. An unauthenticated attacker could access the endpoints, and potentially execute code."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad en Polarion ALM (todas las versiones). Los endpoints de la API REST del conector de puertas del producto afectado carecen de la autenticaci\u00f3n adecuada. Un atacante no autenticado podr\u00eda acceder a los endpoints y potencialmente ejecutar c\u00f3digo."}], "id": "CVE-2024-23813", "lastModified": "2024-11-21T08:58:28.663", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "productcert@siemens.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-02-13T09:15:50.140", "references": [{"source": "productcert@siemens.com", "tags": ["Vendor Advisory"], "url": "https://cert-portal.siemens.com/productcert/html/ssa-871717.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://cert-portal.siemens.com/productcert/html/ssa-871717.html"}], "sourceIdentifier": "productcert@siemens.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "productcert@siemens.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-287"}], "source": "nvd@nist.gov", "type": "Primary"}]}