SSA-740594: Privilege Escalation Vulnerability in Mendix SAML Module
The latest updates of Mendix the SAML module fixes two vulnerabilities. One is an XML External Entity (XXE) attack that could allow an attacker to potentially disclose confidential data under certain circumstances the other is an Cross Site Scripting (XSS) attack allowing to execute malicious code by tricking users into accessing a malicious link . Mendix has released an update for the Mendix SAML module and recommends to update to the latest version.
beschreibt (2)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-32286US | medium6.1 | — | ||
A vulnerability has been identified in Mendix SAML Module (Mendix 7 compatible) (All versions < V1.16.6), Mendix SAML Module (Mendix 8 compatible) (All versions < V2.2.2), Mendix S… | ||||
| CVE-2022-32285US | high7.5 | — | ||
A vulnerability has been identified in Mendix SAML Module (Mendix 7 compatible) (All versions < V1.16.6), Mendix SAML Module (Mendix 8 compatible) (All versions < V2.2.2), Mendix S… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (8)
- MitigationMendix SAML Module (Mendix 9 compatible)
For applications upgraded to Mendix 9 from earlier Mendix versions, the issues have already been resolved in V3.2.2
- MitigationMendix SAML Module (Mendix 9 compatible)
For applications upgraded to Mendix 9 from earlier Mendix versions, the issues have already been resolved in V3.2.2
- BehobenMendix SAML Module (Mendix 7 compatible)
Update to V1.16.6 or later version
https://marketplace.mendix.com/link/component/1174/ - BehobenMendix SAML Module (Mendix 7 compatible)
Update to V1.16.6 or later version
https://marketplace.mendix.com/link/component/1174/ - BehobenMendix SAML Module (Mendix 8 compatible)
Update to V2.2.2 or later version
https://marketplace.mendix.com/link/component/1174/ - BehobenMendix SAML Module (Mendix 8 compatible)
Update to V2.2.2 or later version
https://marketplace.mendix.com/link/component/1174/ - BehobenMendix SAML Module (Mendix 9 compatible)
Update to V3.2.3 or later version
https://marketplace.mendix.com/link/component/1174/ - BehobenMendix SAML Module (Mendix 9 compatible)
Update to V3.2.3 or later version
https://marketplace.mendix.com/link/component/1174/
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan