CVE-2022-46265

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-46265
A vulnerability has been identified in Polarion ALM (All versions < V2304.0). The affected application contains a Host header injection vulnerability that could allow an attacker to spoof a Host header information and redirect users to malicious websites.

5.4 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://cert-portal.siemens.com/productcert/pdf/ssa-792594.pdf Mitigation Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:siemens:polarion_alm:*:*:*:*:*:*:*:*
History

11 Apr 2023, 10:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 6.1 		v2 : unknown
v3 : 5.4
Summary A vulnerability has been identified in Polarion ALM (All versions). The affected application contains a Host header injection vulnerability that could allow an attacker to spoof a Host header information and redirect users to malicious websites. A vulnerability has been identified in Polarion ALM (All versions < V2304.0). The affected application contains a Host header injection vulnerability that could allow an attacker to spoof a Host header information and redirect users to malicious websites.
Information

Published : 2022-12-13 16:15

Updated : 2023-05-16 10:51

NVD link : CVE-2022-46265

Mitre link : CVE-2022-46265

JSON object : View

Products Affected

siemens

  • polarion_alm
CWE
CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')