PT-2022-22173 · Mendix · Mendix Excel Importer Module

Published 2022-07-12 · Updated 2022-07-20 · CVE-2022-34467

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Mendix Excel Importer Module (Mendix 8 compatible) versions prior to 9.2.2 Mendix Excel Importer Module (Mendix 9 compatible) versions prior to 10.1.2

Description A vulnerability has been identified that affects the availability of the Mendix Excel Importer Module. The issue is related to XML Entity Expansion Injection, which an attacker may exploit to compromise the component.

Recommendations For Mendix Excel Importer Module (Mendix 8 compatible) versions prior to 9.2.2, update to version 9.2.2 or later. For Mendix Excel Importer Module (Mendix 9 compatible) versions prior to 10.1.2, update to version 10.1.2 or later.

Fix

XML Entity Expansion

Weakness Enumeration

CWE-776

Related Identifiers

CVE-2022-34467

Affected Products

Mendix Excel Importer Module

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2022-34467 · Security Note
• https://osv.dev/vulnerability/CVE-2022-34467 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-610768.pdf · Vendor Advisory