PT-2022-16598 · Mendix · Mendix Runtime V8+2

Published 2022-03-08 · Updated 2024-10-08 · CVE-2022-24309

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Mendix Runtime V7 versions prior to 7.23.29 Mendix Runtime V8 versions prior to 8.18.16 Mendix Runtime V9 version 9.13 and earlier, with Runtime Custom Setting DataStorage.UseNewQueryHandler set to False

Description A vulnerability has been identified where Mendix Runtime may not apply checks for XPath constraints that parse associations readable by the user. This could allow a malicious user to dump and manipulate sensitive data within apps running on affected versions.

Recommendations For Mendix Runtime V7 versions prior to 7.23.29, update to version 7.23.29 or later. For Mendix Runtime V8 versions prior to 8.18.16, update to version 8.18.16 or later. For Mendix Runtime V9 version 9.13 and earlier with DataStorage.UseNewQueryHandler set to False, update to a version where DataStorage.UseNewQueryHandler is set to True or later, or update to a version where this vulnerability is fixed.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2022-24309

Affected Products

Mendix Runtime V7

Mendix Runtime V8

Mendix Runtime V9

References · 4

• https://osv.dev/vulnerability/CVE-2022-24309 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-148641.pdf · Vendor Advisory
• https://cert-portal.siemens.com/productcert/html/ssa-148641.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24309 · Security Note