Siemens Polarion

An authenticated attacker could inject malicious scripts into Polarion that execute in the browsers of other users viewing the affected content, potentially stealing credentials or session data. This could compromise engineering work and project documentation integrity.

Siemens Polarion users and organizations managing industrial automation, electrical grid, or water system projects. Affects engineering teams using V2404 (before 2404.5) and V2410 (before 2410.2) for project collaboration, requirements management, and design documentation.

An attacker with valid Polarion credentials could inject JavaScript code into project data, work items, or comments. When other users access the affected content, the malicious script executes in their browser, allowing the attacker to capture sensitive information or perform actions on their behalf.