SSA-134279

csafDEsiemens_psirt

SSA-134279: Vulnerability in Mendix Forgot Password Appstore module

view advisory published 2022-03-08

Mendix Forgot Password Appstore module contains two vulnerabilities that could allow unauthorized users to take over accounts. Mendix has released an update for the Mendix Forgot Password Appstore module and recommends to update to the latest version.

01

describes (2)

Related CVEs.

IDseverity exploitable
CVE-2022-26314UScritical9.8—
A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions >= V3.3.0 < V3.5.1), Mendix Forgot Password Appstore module (Mendix 7 compatible) (All v…
CVE-2022-26313UScritical9.8—
A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions >= V3.3.0 < V3.5.1). In certain configurations of the affected product, a threat actor c…
02

references

External citations — patches, advisories, analysis.

03

remediations (9)

  • MitigationMendix Forgot Password Appstore module

    CVE-2022-26313: Disable sign up as described in the documentation

  • MitigationMendix Forgot Password Appstore module

    CVE-2022-26313: Disable sign up as described in the documentation

  • MitigationMendix Forgot Password Appstore module (Mendix 7 compatible)

    CVE-2022-26313: Disable sign up as described in the documentation

  • FixedMendix Forgot Password Appstore module

    Update to V3.5.1 or later

    https://marketplace.mendix.com/link/component/1296
  • FixedMendix Forgot Password Appstore module

    Update to V3.5.1 or later

    https://marketplace.mendix.com/link/component/1296
  • FixedMendix Forgot Password Appstore module (Mendix 7 compatible)

    Update to V3.2.2 or later version

    https://marketplace.mendix.com/link/component/1296
  • WorkaroundMendix Forgot Password Appstore module

    Restrict access to application webserver for trusted users only

  • WorkaroundMendix Forgot Password Appstore module

    Restrict access to application webserver for trusted users only

  • WorkaroundMendix Forgot Password Appstore module (Mendix 7 compatible)

    Restrict access to application webserver for trusted users only

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan