CVE-2021-42025

CWE-863 — Incorrect Authorization3 documents3 sources
Severity
6.5MEDIUM
EPSS
0.1%
top 64.94%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Mendix MendixSiemens Mendix Applications Using Mendix 8Siemens Mendix Applications Using Mendix 9
Timeline
PublishedNov 9
Latest updateMay 24

Description

A vulnerability has been identified in Mendix Applications using Mendix 8 (All versions < V8.18.13), Mendix Applications using Mendix 9 (All versions < V9.6.2). Applications built with affected versions of Mendix Studio Pro do not properly control write access for certain client actions. This could allow authenticated attackers to manipulate the content of System.FileDocument objects in some cases, regardless whether they have write access to it.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶CVEListV5siemens/mendix_applications_using_mendix_8All versions < V8.18.13
▶CVEListV5siemens/mendix_applications_using_mendix_9All versions < V9.6.2
▶NVDmendix/mendix8.0.0 — 8.18.13+1

Patches

Patch: cert-portal.siemens.com ↗Patch: cert-portal.siemens.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-xr6q-pmrg-xhqr: A vulnerability has been identified in Mendix Applications using Mendix 8 (All versions < V8↗2022-05-24
▶
CVEList
CVE-2021-42025: A vulnerability has been identified in Mendix Applications using Mendix 8 (All versions < V8↗2021-11-09
▶