PT-2019-13077 · Mendix · Mendix

Published 2019-09-10 · Updated 2019-09-11 · CVE-2019-12996

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mendix versions 7.23.5 and earlier

Description The issue in XML import mappings allows DOCTYPE declarations in the XML input that is potentially unsafe. This could lead to unsafe processing of XML data.

Recommendations For Mendix versions 7.23.5 and earlier, consider restricting the use of XML import mappings until a fix is available. As a temporary workaround, avoid using DOCTYPE declarations in XML input to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2019-12996

Affected Products

Mendix

References · 3

• https://osv.dev/vulnerability/CVE-2019-12996 · Vendor Advisory
• https://docs.mendix.com/releasenotes/studio-pro/7.23#7236 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12996 · Security Note