CVE-2024-51444 | THREATINT

Description

A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.4). The application insufficiently validates user input for database read queries. This could allow an authenticated remote attacker to conduct an SQL injection attack that bypasses authorization controls and allows to download any data from the application's database.

Reserved 2024-10-28 | Published 2025-05-13 | Updated 2025-05-13 | Assigner siemens

MEDIUM: 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

HIGH: 7.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Problem types

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

Default status

unknown

Any version before *

affected

Default status

unknown

Any version before V2404.4

affected

References

cert-portal.siemens.com/productcert/html/ssa-162255.html

cve.org (CVE-2024-51444)

nvd.nist.gov (CVE-2024-51444)

Download JSON