{"id":"CVE-2024-23813","aliases":["EUVD-2024-21266","GHSA-f8v6-h8xc-6v8q"],"status":"published","title":"A vulnerability has been identified in Polarion ALM (All versions). The REST API endpoints of...","description":"A vulnerability has been identified in Polarion ALM (All versions \u003c V2404.0). The REST API endpoints of doorsconnector of the affected product lacks proper authentication. An unauthenticated attacker could access the endpoints, and potentially execute code.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00589,"percentile":0.48635,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-287"],"published":"2024-02-13T09:00:25Z","modified":"2026-06-17T07:13:39Z","products":[{"vendor":"siemens","product":"polarion alm"},{"vendor":"siemens","product":"polarion_alm"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-871717.html","tags":["x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23813"},{"url":"https://github.com/advisories/GHSA-f8v6-h8xc-6v8q"}],"sources":{"cve":[{"id":"CVE-2024-23813","description":"A vulnerability has been identified in Polarion ALM (All versions \u003c V2404.0). The REST API endpoints of doorsconnector of the affected product lacks proper authentication. An unauthenticated attacker could access the endpoints, and potentially execute code.","status":"published","published":"2024-02-13T09:00:25.915Z","modified":"2025-05-09T18:28:11.158Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C","level":"high","assessor":"cna"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:34:05.077718Z"}],"euvd":[{"id":"EUVD-2024-21266","description":"A vulnerability has been identified in Polarion ALM (All versions \u003c V2404.0). The REST API endpoints of doorsconnector of the affected product lacks proper authentication. An unauthenticated attacker could access the endpoints, and potentially execute code.","status":"published","published":"2024-02-13T09:00:25Z","modified":"2025-05-09T18:28:11Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C","level":"high"}],"updated_at":"2026-11-02T20:32:50.734545Z"}],"ghsa":[{"id":"GHSA-f8v6-h8xc-6v8q","title":"A vulnerability has been identified in Polarion ALM (All versions). The REST API endpoints of...","description":"A vulnerability has been identified in Polarion ALM (All versions). The REST API endpoints of doorsconnector of the affected product lacks proper authentication. An unauthenticated attacker could access the endpoints, and potentially execute code.","status":"published","published":"2024-02-13T09:30:33Z","modified":"2024-02-13T09:30:37Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:55:36.780787Z"}],"nvd":[{"id":"CVE-2024-23813","description":"A vulnerability has been identified in Polarion ALM (All versions \u003c V2404.0). The REST API endpoints of doorsconnector of the affected product lacks proper authentication. An unauthenticated attacker could access the endpoints, and potentially execute code.","status":"published","published":"2024-02-13T09:15:50.14Z","modified":"2026-06-17T07:13:39.27Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:09:35.738752Z"}]}}