SSA-148641: XPath Constraint Vulnerability in Mendix Runtime
A XPath Constraint vulnerability in the Mendix Runtime was discovered, that can affect the running applications. The vulnerability could allow a malicious user to deduce contents of inaccessible attributes and modify sensitive data. Siemens has released new versions for the affected products and recommends to update to the latest versions.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-24309US | high8.1 | — | ||
A vulnerability has been identified in Mendix Runtime V7 (All versions < V7.23.29), Mendix Runtime V8 (All versions < V8.18.16), Mendix Runtime V9 (All versions < V9.13 only with R… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (4)
- MitigationMendix Runtime V9
For versions < V9.13: Set Runtime Custom Setting DataStorage.UseNewQueryHandler to True or remove the custom setting. The value is set to True by default (see https://docs.mendix.com/developerportal/deploy/environments-details#runtime-tab)
- BehobenMendix Runtime V7
Update to V7.23.29 or later version
- BehobenMendix Runtime V8
Update to V8.18.16 or later version
- BehobenMendix Runtime V9
Update to V9.13 or later version
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan