SSA-740594: Privilege Escalation Vulnerability in Mendix SAML Module
The latest updates of Mendix the SAML module fixes two vulnerabilities. One is an XML External Entity (XXE) attack that could allow an attacker to potentially disclose confidential data under certain circumstances the other is an Cross Site Scripting (XSS) attack allowing to execute malicious code by tricking users into accessing a malicious link . Mendix has released an update for the Mendix SAML module and recommends to update to the latest version.
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-32286US | medium6.1 | — | ||
A vulnerability has been identified in Mendix SAML Module (Mendix 7 compatible) (All versions < V1.16.6), Mendix SAML Module (Mendix 8 compatible) (All versions < V2.2.2), Mendix S… | ||||
| CVE-2022-32285US | high7.5 | — | ||
A vulnerability has been identified in Mendix SAML Module (Mendix 7 compatible) (All versions < V1.16.6), Mendix SAML Module (Mendix 8 compatible) (All versions < V2.2.2), Mendix S… | ||||
references
External citations — patches, advisories, analysis.
remediations (8)
- MitigationMendix SAML Module (Mendix 9 compatible)
For applications upgraded to Mendix 9 from earlier Mendix versions, the issues have already been resolved in V3.2.2
- MitigationMendix SAML Module (Mendix 9 compatible)
For applications upgraded to Mendix 9 from earlier Mendix versions, the issues have already been resolved in V3.2.2
- FixedMendix SAML Module (Mendix 7 compatible)
Update to V1.16.6 or later version
https://marketplace.mendix.com/link/component/1174/ - FixedMendix SAML Module (Mendix 7 compatible)
Update to V1.16.6 or later version
https://marketplace.mendix.com/link/component/1174/ - FixedMendix SAML Module (Mendix 8 compatible)
Update to V2.2.2 or later version
https://marketplace.mendix.com/link/component/1174/ - FixedMendix SAML Module (Mendix 8 compatible)
Update to V2.2.2 or later version
https://marketplace.mendix.com/link/component/1174/ - FixedMendix SAML Module (Mendix 9 compatible)
Update to V3.2.3 or later version
https://marketplace.mendix.com/link/component/1174/ - FixedMendix SAML Module (Mendix 9 compatible)
Update to V3.2.3 or later version
https://marketplace.mendix.com/link/component/1174/
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan