CVE-2022-25650

CWE-284 — Improper Access ControlCWE-668 — Exposure to Wrong Sphere3 documents3 sources
Severity
6.5MEDIUM
EPSS
0.3%
top 49.40%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Mendix MendixSiemens Mendix Applications Using Mendix 7Siemens Mendix Applications Using Mendix 8+2 more
Timeline
PublishedApr 12
Latest updateApr 13

Description

A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.27), Mendix Applications using Mendix 8 (All versions < V8.18.14), Mendix Applications using Mendix 9 (All versions < V9.12.0), Mendix Applications using Mendix 9 (V9.6) (All versions < V9.6.3). When querying the database, it is possible to sort the results using a protected field. With this an authenticated attacker could extract information about the contents of a protected field.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages5 packages

▶CVEListV5siemens/mendix_applications_using_mendix_7All versions < V7.23.27
▶CVEListV5siemens/mendix_applications_using_mendix_8All versions < V8.18.14
▶CVEListV5siemens/mendix_applications_using_mendix_9All versions < V9.12.0
▶CVEListV5siemens/mendix_applications_using_mendix_9_(v9.6)All versions < V9.6.3
▶NVDmendix/mendix7.0.0 — 7.23.27+2

Patches

Patch: cert-portal.siemens.com ↗Patch: cert-portal.siemens.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-55f6-4gr7-2ww5: A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7↗2022-04-13
▶
CVEList
CVE-2022-25650: A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7↗2022-04-12
▶