Multiple Vulnerabilities in Polarion Before V2410

An attacker with valid credentials could extract sensitive project data, inject malicious scripts, or discover valid system usernames. These vulnerabilities do not directly affect plant operations but could compromise confidentiality of engineering data and enable subsequent attacks against operational systems.

This affects organizations using Polarion for project management and requirements tracking, particularly those in engineering and manufacturing sectors that integrate Polarion with operational technology systems or store safety-critical engineering data. Water utilities and electric utilities using Polarion for SCADA design documentation or operational procedures are at risk.

An attacker with login credentials accesses Polarion through the web interface and injects SQL commands in input fields, sends specially crafted XML payloads to trigger external entity injection, or submits JavaScript payloads that execute in other users' browsers. The attacker could extract data from the database, access external files on the server, or harvest information from other authenticated users.