Expression Injection Vulnerability in Mendix Runtime Applications
CVE-2022-34466

6.5MEDIUM

Key Information:

Vendor
Siemens
Status
Mendix Applications Using Mendix 9
Mendix Applications Using Mendix 9 (v9.12)
Vendor
CVE Published:
12 July 2022

Summary

An expression injection vulnerability has been found in the Workflow subsystem of Mendix Runtime, which affects various versions of Mendix 9 applications. This vulnerability may allow malicious users to exploit specific configurations, potentially leading to sensitive information leakage. Application developers must ensure that they apply the latest updates to protect their systems from such threats.

Affected Version(s)

Mendix Applications using Mendix 9 All versions >= V9.11 < V9.15

Mendix Applications using Mendix 9 (V9.12) All versions < V9.12.3

References

https://cert-portal.siemens.com/productcert/pdf/ssa-49217...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.