Siemens Mendix
A XPath Constraint vulnerability in the Mendix Runtime was discovered, that can affect the running applications. The vulnerability could allow a malicious user to deduce contents of inaccessible attributes and modify sensitive data. Siemens has released new versions for the affected products and recommends to update to the latest versions.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-24309US | high8.1 | — | ||
A vulnerability has been identified in Mendix Runtime V7 (All versions < V7.23.29), Mendix Runtime V8 (All versions < V8.18.16), Mendix Runtime V9 (All versions < V9.13 only with R… | ||||
references
External citations — patches, advisories, analysis.
- SSA-148641: XPath Constraint Vulnerability in Mendix Runtime - CSAF Versionself
- SSA-148641: XPath Constraint Vulnerability in Mendix Runtime - HTML Versionself
- ICS Advisory ICSA-22-069-13 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-22-069-13 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (4)
- MitigationMendix Runtime V9
For versions < V9.13: Set Runtime Custom Setting DataStorage.UseNewQueryHandler to True or remove the custom setting. The value is set to True by default (see https://docs.mendix.com/developerportal/deploy/environments-details#runtime-tab)
- FixedMendix Runtime V7
Update to V7.23.29 or later version
- FixedMendix Runtime V8
Update to V8.18.16 or later version
- FixedMendix Runtime V9
Update to V9.13 or later version
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan