XSS in Mendix Saml
CVE-2022-32286
A vulnerability has been identified in Mendix SAML Module (Mendix 7 compatible) (All versions < V1.16.6), Mendix SAML Module (Mendix 8 compatible) (All versions < V2.2.2), Mendix SAML Module (Mendix 9 compatible) (All versions < V3.2.3). In certain configurations SAML module is vulnerable to Cross Site Scripting (XSS) attacks due to insufficient error message sanitation. This could allow an attacker to execute malicious code by tricking users into accessing a malicious link.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.005 (42.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Mendix Saml
- Siemens Mendix Saml Module (Mendix 7 Compatible) — versions All versions < V1.16.6
- Siemens Mendix Saml Module (Mendix 8 Compatible) — versions All versions < V2.2.2
- Siemens Mendix Saml Module (Mendix 9 Compatible) — versions All versions < V3.2.3
Weakness classification (CWE)
References
- productcert@siemens.com (Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2022-32286?
- CVE-2022-32286 is a medium-severity vulnerability in Mendix Saml, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2022-06-14.
- How severe is CVE-2022-32286?
- Medium severity. CVSS v3 base score is 6.1 out of 10.