Cross-site scripting in Siemens Polarion ALM
Priority LOW 29CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
A vulnerability has been identified in Polarion ALM (All versions < V21 R2 P2), Polarion WebClient for SVN (All versions). A cross-site scripting is present due to improper neutralization of data sent to the web page through the SVN WebClient in the affected product. An attacker could exploit this to execute arbitrary code and extract sensitive information by sending a specially crafted link to users with administrator privileges.
Why it matters now
EPSS 0.00761 55th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Siemens | Polarion ALM | All versions < V21 R2 P2 | — | No fix listed | CNA |
| Siemens | Polarion WebClient for SVN | All versions | — | No fix listed | CNA |
- Polarion ALM VendorSiemens Affected All versions < V21 R2 P2 Fixed in — No fix listed CNA
- Polarion WebClient for SVN VendorSiemens Affected All versions Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:siemens:polarion_alm:*:*:*:*:*:*:*:* | before 21.0 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:polarion_alm:21.0:-:*:*:*:*:*:* | 21.0 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:polarion_alm:21.0:r1:*:*:*:*:*:* | 21.0 r1 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:polarion_alm:21.0:r2:*:*:*:*:*:* | 21.0 r2 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:polarion_subversion_webclient:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
- cpe:2.3:a:siemens:polarion_alm:*:*:*:*:*:*:*:* Versions before 21.0 Vulnerable ·Siemens
- cpe:2.3:a:siemens:polarion_alm:21.0:-:*:*:*:*:*:* Versions 21.0 Vulnerable ·Siemens
- cpe:2.3:a:siemens:polarion_alm:21.0:r1:*:*:*:*:*:* Versions 21.0 r1 Vulnerable ·Siemens
- cpe:2.3:a:siemens:polarion_alm:21.0:r2:*:*:*:*:*:* Versions 21.0 r2 Vulnerable ·Siemens
- cpe:2.3:a:siemens:polarion_subversion_webclient:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-44478
- 2026-10-03 Alias added: GHSA-44g4-c9hw-qp42
References
More Siemens Polarion Alm vulnerabilities
- TI-2024-15807 Improper authentication in Siemens Polarion ALM CVSS 3.1CRITICAL 9.8
- TI-2024-34376 A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All… CVSS 4.0MEDIUM 6.9
- TI-2023-27468 Incorrect default permissions in Siemens Polarion ALM CVSS 3.1HIGH 7.8
- TI-2023-13334 XML external entity injection in Siemens Polarion ALM CVSS 3.1HIGH 7.5
- TI-2024-34374 XML external entity injection in Siemens Polarion V2310 CVSS 4.0HIGH 7.1
- TI-2024-34373 SQL injection in Siemens Polarion V2310 CVSS 4.0HIGH 7.1
Sources
- CVE-2021-44478 · CVE Program
- CVE-2021-44478 · NVD
- FIRST EPSS
- GHSA-44g4-c9hw-qp42 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences