Vulnerability in Mendix
CVE-2022-25650
A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.27), Mendix Applications using Mendix 8 (All versions < V8.18.14), Mendix Applications using Mendix 9 (All versions < V9.12.0), Mendix Applications using Mendix 9 (V9.6) (All versions < V9.6.3). When querying the database, it is possible to sort the results using a protected field. With this an authenticated attacker could extract information about the contents of a protected field.
EPSS: 0.006 (47.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Mendix
- Siemens Mendix Applications Using 7 — versions All versions < V7.23.27
- Siemens Mendix Applications Using 8 — versions All versions < V8.18.14
- Siemens Mendix Applications Using 9 — versions All versions < V9.12.0
- Siemens Mendix Applications Using 9 (V9.6) — versions All versions < V9.6.3
Weakness classification (CWE)
References
- productcert@siemens.com (Patch, x_refsource_MISC, Mitigation, Vendor Advisory)
Frequently asked questions
- What is CVE-2022-25650?
- CVE-2022-25650 is a medium-severity vulnerability in Mendix, classified under Improper Access Control. CVSS score: 6.5/10. Published 2022-04-12.
- How severe is CVE-2022-25650?
- Medium severity. CVSS v3 base score is 6.5 out of 10.