Siemens Polarion versions prior to V2404.5 and V2410.2 are vulnerable to stored cross-site scripting, which could allow authenticated attackers to execute malicious scripts in the context of other users.

This is a stored cross-site scripting (CWE-79) vulnerability. The application fails to properly neutralize input in document titles, allowing an authenticated remote attacker to inject and store arbitrary JavaScript that executes when other users view the affected document.

Successful exploitation allows an attacker to execute unauthorized scripts within the browser session of other users, including administrators. This could result in session hijacking, unauthorized actions performed on behalf of legitimate users, or the theft of sensitive data. Given the CVSS score of 7.6, the vulnerability presents a significant risk to the integrity and confidentiality of the application environment.

Immediate Action: Update Siemens Polarion to version V2404.5 or V2410.2, or later, as provided by the vendor security advisory.

Proactive Monitoring: Monitor application access logs for unusual activity related to document title modifications and review browser-based security alerts for signs of script injection.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common cross-site scripting patterns in input fields, particularly those involving document metadata.

Public Exploit Available: Unknown

The vulnerability poses a moderate to high risk to internal security by facilitating cross-site scripting attacks against legitimate users. Administrators should prioritize the installation of the provided vendor patches to eliminate the underlying input validation deficiency. In environments where immediate patching is not feasible, restrict document creation permissions to trusted users to reduce the attack surface.