ICSA-23-012-09

Siemens Mendix SAML Module

view advisory published 2023-01-10

The Mendix SAML module is affected by a reflected cross-site scripting (XSS) vulnerability that could allow an attacker to extract sensitive information by tricking users into accessing a malicious link. Apps are only vulnerable in certain cases when non-default configuration is used. Siemens has released updates for the affected products and recommends to update to the latest versions.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-46823US	medium6.1	0.48% (41st)	—	2023-01-10
A vulnerability has been identified in Mendix SAML (Mendix 8 compatible) (All versions >= V2.3.0 < V2.3.4), Mendix SAML (Mendix 9 compatible, New Track) (All versions >= V3.3.0 < V…

references

External citations — patches, advisories, analysis.

remediations (6)

MitigationMendix SAML (Mendix 8 compatible)
Enable two-factor authentication (2FA), if possible
MitigationMendix SAML (Mendix 9 compatible, New Track)
Enable two-factor authentication (2FA), if possible
MitigationMendix SAML (Mendix 9 compatible, Upgrade Track)
Enable two-factor authentication (2FA), if possible
FixedMendix SAML (Mendix 8 compatible)
Update to V2.3.4 or later version
https://marketplace.mendix.com/link/component/1174/
FixedMendix SAML (Mendix 9 compatible, New Track)
Update to V3.3.9 or later version
https://marketplace.mendix.com/link/component/1174/
FixedMendix SAML (Mendix 9 compatible, Upgrade Track)
Update to V3.3.8 or later version
https://marketplace.mendix.com/link/component/1174/

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan