CVE-2021-44478

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-03-08 · updated 2026-06-17
Weakness: CWE-79

Description

A vulnerability has been identified in Polarion ALM (All versions < V21 R2 P2), Polarion WebClient for SVN (All versions). A cross-site scripting is present due to improper neutralization of data sent to the web page through the SVN WebClient in the affected product. An attacker could exploit this to execute arbitrary code and extract sensitive information by sending a specially crafted link to users with administrator privileges.

Affected products

Siemens Polarion ALM: before 21.0; 21.0, 21.0-r1, 21.0-r2 — fixed in 21.0
Siemens AG Polarion Subversion Webclient: all versions

How to fix

Upgrade to a fixed version: Siemens Polarion ALM 21.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-44478 or the next vulnerability affects your stack