{"id":"CVE-2024-33647","aliases":["EUVD-2024-31363","GHSA-829x-599p-43vg"],"status":"published","title":"A vulnerability has been identified in Polarion ALM (All versions \u003c V2404.0). The Apache Lucene...","description":"A vulnerability has been identified in Polarion ALM (All versions \u003c V2404.0). The Apache Lucene based query engine in the affected application lacks proper access controls. This could allow an authenticated user to query items beyond the user's allowed projects.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00423,"percentile":0.3705,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-284","CWE-862"],"published":"2024-05-14T10:03:08Z","modified":"2026-06-17T07:32:09Z","products":[{"vendor":"siemens","product":"polarion alm"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-925850.html","tags":["x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-33647"},{"url":"https://github.com/advisories/GHSA-829x-599p-43vg"}],"sources":{"cve":[{"id":"CVE-2024-33647","description":"A vulnerability has been identified in Polarion ALM (All versions \u003c V2404.0). The Apache Lucene based query engine in the affected application lacks proper access controls. This could allow an authenticated user to query items beyond the user's allowed projects.","status":"published","published":"2024-05-14T10:03:08.35Z","modified":"2025-08-27T21:13:00.144Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:34:21.404483Z"}],"euvd":[{"id":"EUVD-2024-31363","description":"A vulnerability has been identified in Polarion ALM (All versions \u003c V2404.0). The Apache Lucene based query engine in the affected application lacks proper access controls. This could allow an authenticated user to query items beyond the user's allowed projects.","status":"published","published":"2024-05-14T10:03:08Z","modified":"2025-08-27T21:13:00Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:31:50.600254Z"}],"ghsa":[{"id":"GHSA-829x-599p-43vg","title":"A vulnerability has been identified in Polarion ALM (All versions \u003c V2404.0). The Apache Lucene...","description":"A vulnerability has been identified in Polarion ALM (All versions \u003c V2404.0). The Apache Lucene based query engine in the affected application lacks proper access controls. This could allow an authenticated user to query items beyond the user's allowed projects.","status":"published","published":"2024-05-14T18:31:01Z","modified":"2025-02-04T18:30:46Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-284","CWE-862"],"updated_at":"2026-11-02T14:59:47.147393Z"}],"nvd":[{"id":"CVE-2024-33647","description":"A vulnerability has been identified in Polarion ALM (All versions \u003c V2404.0). The Apache Lucene based query engine in the affected application lacks proper access controls. This could allow an authenticated user to query items beyond the user's allowed projects.","status":"published","published":"2024-05-14T16:17:21.7Z","modified":"2026-06-17T07:32:09.213Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:09:58.124007Z"}]}}