SSA-134279

csafDEsiemens_psirt

SSA-134279: Vulnerability in Mendix Forgot Password Appstore module

Advisory ansehen veröffentlicht 2022-03-08

Mendix Forgot Password Appstore module contains two vulnerabilities that could allow unauthorized users to take over accounts. Mendix has released an update for the Mendix Forgot Password Appstore module and recommends to update to the latest version.

01

beschreibt (2)

Zugehörige CVEs.

IDSchweregrad ausnutzbar
CVE-2022-26314UScritical9.8—
A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions >= V3.3.0 < V3.5.1), Mendix Forgot Password Appstore module (Mendix 7 compatible) (All v…
CVE-2022-26313UScritical9.8—
A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions >= V3.3.0 < V3.5.1). In certain configurations of the affected product, a threat actor c…
02

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

03

Behebungen (9)

  • MitigationMendix Forgot Password Appstore module

    CVE-2022-26313: Disable sign up as described in the documentation

  • MitigationMendix Forgot Password Appstore module

    CVE-2022-26313: Disable sign up as described in the documentation

  • MitigationMendix Forgot Password Appstore module (Mendix 7 compatible)

    CVE-2022-26313: Disable sign up as described in the documentation

  • BehobenMendix Forgot Password Appstore module

    Update to V3.5.1 or later

    https://marketplace.mendix.com/link/component/1296
  • BehobenMendix Forgot Password Appstore module

    Update to V3.5.1 or later

    https://marketplace.mendix.com/link/component/1296
  • BehobenMendix Forgot Password Appstore module (Mendix 7 compatible)

    Update to V3.2.2 or later version

    https://marketplace.mendix.com/link/component/1296
  • WorkaroundMendix Forgot Password Appstore module

    Restrict access to application webserver for trusted users only

  • WorkaroundMendix Forgot Password Appstore module

    Restrict access to application webserver for trusted users only

  • WorkaroundMendix Forgot Password Appstore module (Mendix 7 compatible)

    Restrict access to application webserver for trusted users only

scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan