Republished vendor advisory. This ICSA is a verbatim republication of Siemens ProductCERT SSA-162255 from a direct conversion of their vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA…
General Recommendations: As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
Additional Resources: For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
Credit: Siemens ProductCERT
From CISA's machine-readable CSAF 2.0 advisory (JSON).
| CVE | Weakness | CVSS v3 | Details |
|---|---|---|---|
| CVE-2024-51444 | CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 6.5 Medium |
CVE-2024-51444 The application insufficiently validates user input for database read queries. This could allow an authenticated remote attacker to conduct an SQL injection attack that bypasses authorization controls and allows to download any data from the application's database. No fix planned: Currently no fix is planned Vendor fix: Update to V2404.4 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2024-51445 | CWE-611 Improper Restriction of XML External Entity Reference | 6.5 Medium |
CVE-2024-51445 The affected application contains a XML External Entity Injection (XXE) vulnerability in the docx import feature. This could allow an authenticated remote attacker to read arbitrary data from the application server. No fix planned: Currently no fix is planned Vendor fix: Update to V2404.4 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2024-51446 | CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 6.5 Medium |
CVE-2024-51446 The file upload feature of the affected application improperly sanitizes xml files. This could allow an authenticated remote attacker to conduct a stored cross-site scripting attack by uploading specially crafted xml files that are later downloaded and viewed by other users of the application. No fix planned: Currently no fix is planned Vendor fix: Update to V2404.4 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2024-51447 | CWE-204 Observable Response Discrepancy | 5.3 Medium |
CVE-2024-51447 The login implementation of the affected application contains an observable response discrepancy vulnerability when validating usernames. This could allow an unauthenticated remote attacker to distinguish between valid and invalid usernames. No fix planned: Currently no fix is planned Vendor fix: Update to V2404.2 or later version ↗ Affected, fixed & timelineAffected:
|
Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.
No coverage found in monitored research blogs or news feeds.
| CVE | CVSS | Affected |
|---|---|---|
| CVE-2024-51444 | 6.5 Medium | Siemens Polarion V2310 A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.4). The application insufficiently validat… |
| CVE-2024-51445 | 6.5 Medium | Siemens Polarion V2310 A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.4). The affected application contains a XM… |
| CVE-2024-51446 | 6.5 Medium | Siemens Polarion V2310 A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.4). The file upload feature of the affecte… |
| CVE-2024-51447 | 5.3 Medium | Siemens Polarion V2310 A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.2). The login implementation of the affect… |
Named by the advisory itself. Each CVE links to its tracked detail page.
Each vendor links to its Known Exploited Vulnerabilities catalog page. Only vendors that appear in the KEV catalog are listed, either because the publication cites one of their KEV entries or because it names them directly.