PT-2022-17781 · Mendix · Mendix Forgot Password Appstore Module

Published 2022-03-08 · Updated 2022-03-11 · CVE-2022-26313

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mendix Forgot Password Appstore module versions 3.3.0 through 3.5.0

Description A vulnerability has been identified in certain configurations of the Mendix Forgot Password Appstore module, where a threat actor could use the sign up flow to hijack arbitrary user accounts.

Recommendations For Mendix Forgot Password Appstore module versions 3.3.0 through 3.5.0, update to version 3.5.1 or later to resolve the issue.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2022-26313

Affected Products

Mendix Forgot Password Appstore Module

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2022-26313 · Security Note
• https://osv.dev/vulnerability/CVE-2022-26313 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-134279.pdf · Vendor Advisory