Siemens Polarion

An authenticated attacker could inject malicious scripts that execute in the browsers of other Polarion users, potentially stealing session credentials or performing actions on their behalf within the Polarion system.

Siemens Polarion users, particularly those managing requirements, test cases, or documents through the web interface. This affects any organization using Polarion V2404 (before 2404.5) or V2410 (before 2410.2) for product lifecycle management, software engineering collaboration, or quality assurance workflows.

An attacker with valid Polarion credentials inputs malicious JavaScript code into a vulnerable input field. When other users view the affected page or content, the script executes in their browser in the context of their Polarion session, allowing the attacker to harvest credentials or trigger unintended actions.