PT-2022-3547 · Mendix · Mendix

Published 2022-04-12 · Updated 2023-07-11 · CVE-2022-25650

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mendix Applications using Mendix 7 versions prior to 7.23.27 Mendix Applications using Mendix 8 versions prior to 8.18.14 Mendix Applications using Mendix 9 versions prior to 9.12.0 Mendix Applications using Mendix 9 (V9.6) versions prior to 9.6.3

Description A vulnerability has been identified in Mendix Applications. When querying the database, it is possible to sort the results using a protected field. With this, an authenticated attacker could extract information about the contents of a protected field. The issue is related to configuration errors in the database of the Mendix platform.

Recommendations For Mendix 7 versions prior to 7.23.27, update to version 7.23.27 or later to resolve the issue. For Mendix 8 versions prior to 8.18.14, update to version 8.18.14 or later to resolve the issue. For Mendix 9 versions prior to 9.12.0, update to version 9.12.0 or later to resolve the issue. For Mendix 9 (V9.6) versions prior to 9.6.3, update to version 9.6.3 or later to resolve the issue. As a temporary workaround, consider restricting access to protected fields in the database to minimize the risk of exploitation.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2022-04331

CVE-2022-25650

Affected Products

Mendix

References · 5

• https://cert-portal.siemens.com/productcert/pdf/ssa-870917.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25650 · Security Note
• https://osv.dev/vulnerability/CVE-2022-25650 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04331 · Security Note
• https://t.me/cibsecurity/40602 · Telegram Post