CVE-2021-44478

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-44478
A vulnerability has been identified in Polarion ALM (All versions < V21 R2 P2), Polarion WebClient for SVN (All versions). A cross-site scripting is present due to improper neutralization of data sent to the web page through the SVN WebClient in the affected product. An attacker could exploit this to execute arbitrary code and extract sensitive information by sending a specially crafted link to users with administrator privileges.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

4.3 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
https://cert-portal.siemens.com/productcert/pdf/ssa-562051.pdf Patch Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:siemens:polarion_alm:*:*:*:*:*:*:*:*
cpe:2.3:a:siemens:polarion_alm:21.0:-:*:*:*:*:*:*
cpe:2.3:a:siemens:polarion_alm:21.0:r1:*:*:*:*:*:*
cpe:2.3:a:siemens:polarion_alm:21.0:r2:*:*:*:*:*:*
cpe:2.3:a:siemens:polarion_subversion_webclient:*:*:*:*:*:*:*:*
History

28 Jul 2022, 18:12

Type Values Removed Values Added
CPE cpe:2.3:a:siemens:polarion_subversion_webclient:21:r1:*:*:*:*:*:* cpe:2.3:a:siemens:polarion_alm:21.0:r2:*:*:*:*:*:*
cpe:2.3:a:siemens:polarion_alm:*:*:*:*:*:*:*:*
cpe:2.3:a:siemens:polarion_subversion_webclient:*:*:*:*:*:*:*:*
cpe:2.3:a:siemens:polarion_alm:21.0:-:*:*:*:*:*:*
cpe:2.3:a:siemens:polarion_alm:21.0:r1:*:*:*:*:*:*

12 Apr 2022, 10:15

Type Values Removed Values Added
Summary A vulnerability has been identified in Polarion ALM (All versions < V21 R2 P2), Polarion WebClient for SVN (All versions). A cross-site scripting is present due to improper neutralization of data sent to the web page through the SVN WebClient in the affected product. An attacker could exploit this to execute arbitrary code and extract sensitive information by sending a specially crafted link to users with administrator privileges. A vulnerability has been identified in Polarion ALM (All versions < V21 R2 P2), Polarion WebClient for SVN (All versions). A cross-site scripting is present due to improper neutralization of data sent to the web page through the SVN WebClient in the affected product. An attacker could exploit this to execute arbitrary code and extract sensitive information by sending a specially crafted link to users with administrator privileges.

12 Apr 2022, 09:15

Type Values Removed Values Added
Summary A vulnerability has been identified in Polarion Subversion Webclient (V21 R1). A cross-site scripting is present due to improper neutralization of data sent to the web page through the SVN WebClient in the affected product. An attacker could exploit this to execute arbitrary code and extract sensitive information by sending a specially crafted link to users with administrator privileges. A vulnerability has been identified in Polarion ALM (All versions < V21 R2 P2), Polarion WebClient for SVN (All versions). A cross-site scripting is present due to improper neutralization of data sent to the web page through the SVN WebClient in the affected product. An attacker could exploit this to execute arbitrary code and extract sensitive information by sending a specially crafted link to users with administrator privileges.

11 Mar 2022, 17:58

Type Values Removed Values Added
References (CONFIRM) https://cert-portal.siemens.com/productcert/pdf/ssa-562051.pdf - (CONFIRM) https://cert-portal.siemens.com/productcert/pdf/ssa-562051.pdf - Patch, Vendor Advisory
CPE cpe:2.3:a:siemens:polarion_subversion_webclient:21:r1:*:*:*:*:*:*
CWE CWE-79
CVSS v2 : unknown
v3 : unknown 		v2 : 4.3
v3 : 6.1

10 Mar 2022, 17:44

Type Values Removed Values Added
Summary A vulnerability has been identified in Polarion Subversion Webclient (V21 R1). A cross-site scripting is present due to improper neutralization of data sent to the web page through the SVN WebClient in the affected product. An attacker could exploit this to execute arbitrary code and extract sensitive information by sending a specially crafted link to users with administrator privileges. A vulnerability has been identified in Polarion Subversion Webclient (V21 R1). A cross-site scripting is present due to improper neutralization of data sent to the web page through the SVN WebClient in the affected product. An attacker could exploit this to execute arbitrary code and extract sensitive information by sending a specially crafted link to users with administrator privileges.

08 Mar 2022, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2022-03-08 12:15

Updated : 2024-02-04 22:29

NVD link : CVE-2021-44478

Mitre link : CVE-2021-44478

CVE.ORG link : CVE-2021-44478

JSON object : View

Products Affected

siemens

  • polarion_alm
  • polarion_subversion_webclient
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')