Siemens Mendix SAML Module
The latest updates of Mendix the SAML module fixes two vulnerabilities. One is an XML External Entity (XXE) attack that could allow an attacker to potentially disclose confidential data under certain circumstances the other is an Cross Site Scripting (XSS) attack allowing to execute malicious code by tricking users into accessing a malicious link . Mendix has released an update for the Mendix SAML module and recommends to update to the latest version.
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-32286US | medium6.1 | — | ||
A vulnerability has been identified in Mendix SAML Module (Mendix 7 compatible) (All versions < V1.16.6), Mendix SAML Module (Mendix 8 compatible) (All versions < V2.2.2), Mendix S… | ||||
| CVE-2022-32285US | high7.5 | — | ||
A vulnerability has been identified in Mendix SAML Module (Mendix 7 compatible) (All versions < V1.16.6), Mendix SAML Module (Mendix 8 compatible) (All versions < V2.2.2), Mendix S… | ||||
references
External citations — patches, advisories, analysis.
- SSA-740594: Privilege Escalation Vulnerability in Mendix SAML Module - CSAF Versionself
- SSA-740594: Privilege Escalation Vulnerability in Mendix SAML Module - PDF Versionself
- SSA-740594: Privilege Escalation Vulnerability in Mendix SAML Module - TXT Versionself
- ICS Advisory ICSA-22-167-04 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-22-167-04 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (8)
- MitigationMendix SAML Module (Mendix 9 compatible)
For applications upgraded to Mendix 9 from earlier Mendix versions, the issues have already been resolved in V3.2.2
- MitigationMendix SAML Module (Mendix 9 compatible)
For applications upgraded to Mendix 9 from earlier Mendix versions, the issues have already been resolved in V3.2.2
- FixedMendix SAML Module (Mendix 7 compatible)
Update to V1.16.6 or later version
https://marketplace.mendix.com/link/component/1174/ - FixedMendix SAML Module (Mendix 7 compatible)
Update to V1.16.6 or later version
https://marketplace.mendix.com/link/component/1174/ - FixedMendix SAML Module (Mendix 8 compatible)
Update to V2.2.2 or later version
https://marketplace.mendix.com/link/component/1174/ - FixedMendix SAML Module (Mendix 8 compatible)
Update to V2.2.2 or later version
https://marketplace.mendix.com/link/component/1174/ - FixedMendix SAML Module (Mendix 9 compatible)
Update to V3.2.3 or later version
https://marketplace.mendix.com/link/component/1174/ - FixedMendix SAML Module (Mendix 9 compatible)
Update to V3.2.3 or later version
https://marketplace.mendix.com/link/component/1174/
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan