What is CVE-2021-42025?

CVE-2021-42025 is a medium-severity vulnerability in Mendix, classified under Incorrect Authorization. CVSS score: 6.5/10. Published 2021-11-09.

How severe is CVE-2021-42025?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Auth bypass in Mendix

CVE-2021-42025

A vulnerability has been identified in Mendix Applications using Mendix 8 (All versions < V8.18.13), Mendix Applications using Mendix 9 (All versions < V9.6.2). Applications built with affected versions of Mendix Studio Pro do not properly control write access for certain client actions. This could allow authenticated attackers to manipulate the content of System.FileDocument objects in some cases, regardless whether they have write access to it.

Vulnerability class: Broken Access Control

EPSS: 0.006 (43.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N.

Affected products

Mendix
Siemens Mendix Applications Using 8 — versions All versions < V8.18.13
Siemens Mendix Applications Using 9 — versions All versions < V9.6.2

Weakness classification (CWE)

CWE-863 — Incorrect Authorization

References

productcert@siemens.com (Patch, x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2021-42025?: CVE-2021-42025 is a medium-severity vulnerability in Mendix, classified under Incorrect Authorization. CVSS score: 6.5/10. Published 2021-11-09.
How severe is CVE-2021-42025?: Medium severity. CVSS v3 base score is 6.5 out of 10.