CVE-2024-51446CWE-79

A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.4)

Medium · published May 13, 2025

CVSS v4.0
5.1
EPSS
0%
Percentile
25.8
In the wild
Unconfirmed
What it is

A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.4). The file upload feature of the affected application improperly sanitizes xml files. This could allow an authenticated remote attacker to conduct a stored cross-site scripting attack by uploading specially crafted xml files that are later downloaded and viewed by other users of the application.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L
EPSS
0.00336 · 25.8th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-05-13T09:38Z
EPSS history
Timeline
  • 13 MAY 09:38Z
    A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.4)
    cvelistv5