PT-2023-1146 · Mendix · Mendix Saml

Published 2023-01-10 · Updated 2023-01-16 · CVE-2022-46823

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Mendix SAML (Mendix 8 compatible) versions 2.3.0 through 2.3.3 Mendix SAML (Mendix 9 compatible, New Track) versions 3.3.0 through 3.3.8 Mendix SAML (Mendix 9 compatible, Upgrade Track) versions 3.3.0 through 3.3.7

Description The affected module is vulnerable to reflected cross-site scripting (XSS) attacks, which could allow an attacker to extract sensitive information by tricking users into accessing a malicious link. This issue is related to insufficient protection of the web page structure.

Recommendations For Mendix SAML (Mendix 8 compatible) versions 2.3.0 through 2.3.3, update to version 2.3.4 or later. For Mendix SAML (Mendix 9 compatible, New Track) versions 3.3.0 through 3.3.8, update to version 3.3.9 or later. For Mendix SAML (Mendix 9 compatible, Upgrade Track) versions 3.3.0 through 3.3.7, update to version 3.3.8 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-00347

CVE-2022-46823

Affected Products

Mendix Saml

References · 6

• https://cert-portal.siemens.com/productcert/pdf/ssa-496604.pdf · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00347 · Security Note
• https://osv.dev/vulnerability/CVE-2022-46823 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-46823 · Security Note
• https://t.me/echeloneyes/1082 · Telegram Post
• https://t.me/cibsecurity/56228 · Telegram Post