Loading vulnerability…
Stored XSS in Siemens Polarion Document Titles
CVE-2025-40587 is a stored cross-site scripting vulnerability in Siemens Polarion V2404 releases before V2404.5 and V2410 releases before V2410.2. Insufficient neutralization of document titles allows an authenticated remote attacker to store arbitrary JavaScript in a specially crafted title. The JavaScript executes in another user's browser within the Polarion application context when that user views the malicious title.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can expose information accessible to the victim and enable unauthorized actions or data modification within the victim's Polarion application context. The CVSS v3.1 assessment assigns high confidentiality impact, low integrity impact, and no availability impact, with a base score of 7.6.
If you can’t patch tonight, do this now.
No vendor-provided vulnerability-specific workaround is identified. Until upgrading, restrict document creation and renaming permissions to trusted users, audit suspicious document-title changes, and limit application network access through appropriate access controls. These measures reduce exposure but do not eliminate the underlying vulnerability.
Patch, then assume compromise.
Upgrade Polarion V2404 to V2404.5 or later, or Polarion V2410 to V2410.2 or later. Siemens recommends updating affected products to the latest available releases.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.