Data Manipulation Vulnerability in Mendix Runtime Software

CVE-2022-24309

What is CVE-2022-24309?

A vulnerability exists in Mendix Runtime that allows unauthorized access to sensitive data due to insufficient checks for XPath constraints in certain apps. Specifically, when an entity has an association readable by the user, the affected versions of Mendix Runtime may fail to enforce necessary security measures. This weakness can be exploited by a malicious user to dump and manipulate confidential information stored within applications, posing significant risks to data integrity and confidentiality.

References