CVE-2024-51445CWE-611

A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.4)

High · published May 13, 2025

CVSS v4.0
7.1
EPSS
1%
Percentile
45.1
In the wild
Unconfirmed
What it is

A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.4). The affected application contains a XML External Entity Injection (XXE) vulnerability in the docx import feature. This could allow an authenticated remote attacker to read arbitrary data from the application server.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00548 · 45.1th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2025-05-13T09:38Z
EPSS history
Timeline
  • 13 MAY 09:38Z
    A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.4)
    cvelistv5