Vulnerability in Mendix
CVE-2022-24309
A vulnerability has been identified in Mendix Runtime V7 (All versions < V7.23.29), Mendix Runtime V8 (All versions < V8.18.16), Mendix Runtime V9 (All versions < V9.13 only with Runtime Custom Setting *DataStorage.UseNewQueryHandler* set to False). If an entity has an association readable by the user, then in some cases, Mendix Runtime may not apply checks for XPath constraints that parse said associations, within apps running on affected versions. A malicious user could use this to dump and manipulate sensitive data.
EPSS: 0.006 (45.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N.
Affected products
- Mendix
- Siemens Mendix Runtime V7 — versions 0
- Siemens Mendix Runtime V8 — versions 0
- Siemens Mendix Runtime V9 — versions 0
Weakness classification (CWE)
References
- productcert@siemens.com (x_refsource_MISC, Release Notes, Mitigation, Vendor Advisory)
- productcert@siemens.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2022-24309?
- CVE-2022-24309 is a medium-severity vulnerability in Mendix, classified under Improper Access Control. CVSS score: 6.8/10. Published 2022-03-08.
- How severe is CVE-2022-24309?
- Medium severity. CVSS v3 base score is 6.8 out of 10.