CVE-2021-42026

CWE-863 — Incorrect Authorization3 documents3 sources
Severity
4.3MEDIUM
EPSS
0.1%
top 64.58%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Mendix MendixSiemens Mendix Applications Using Mendix 8Siemens Mendix Applications Using Mendix 9
Timeline
PublishedNov 9
Latest updateMay 24

Description

A vulnerability has been identified in Mendix Applications using Mendix 8 (All versions < V8.18.13), Mendix Applications using Mendix 9 (All versions < V9.6.2). Applications built with affected versions of Mendix Studio Pro do not properly control read access for certain client actions. This could allow authenticated attackers to retrieve the changedDate attribute of arbitrary objects, even when they don't have read access to them.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages3 packages

▶CVEListV5siemens/mendix_applications_using_mendix_8All versions < V8.18.13
▶CVEListV5siemens/mendix_applications_using_mendix_9All versions < V9.6.2
▶NVDmendix/mendix8.0.0 — 8.18.13+1

Patches

Patch: cert-portal.siemens.com ↗Patch: cert-portal.siemens.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-2j3j-g2v5-fh5c: A vulnerability has been identified in Mendix Applications using Mendix 8 (All versions < V8↗2022-05-24
▶
CVEList
CVE-2021-42026: A vulnerability has been identified in Mendix Applications using Mendix 8 (All versions < V8↗2021-11-09
▶