XML External Entity Vulnerability in Mendix SAML Modules
CVE-2022-32285

7.5HIGH

Key Information:

Vendor
Siemens
Status
Mendix Saml Module (mendix 7 Compatible)
Mendix Saml Module (mendix 8 Compatible)
Mendix Saml Module (mendix 9 Compatible)
Vendor
CVE Published:
14 June 2022

Summary

A vulnerability has been identified in the Mendix SAML Module across various Mendix versions, which allows for potential exploitation through XML External Entity (XXE) attacks. This type of vulnerability occurs due to inadequate input sanitation, making it possible for attackers to access and disclose sensitive information in specific scenarios. It is crucial for users of the affected Mendix SAML Modules to update their installations to the latest versions to mitigate the risk of exploitation.

Affected Version(s)

Mendix SAML Module (Mendix 7 compatible) All versions < V1.16.6

Mendix SAML Module (Mendix 8 compatible) All versions < V2.2.2

Mendix SAML Module (Mendix 9 compatible) All versions < V3.2.3

References

https://cert-portal.siemens.com/productcert/pdf/ssa-74059...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.