CVE-2021-42025

A vulnerability has been identified in Mendix Applications using Mendix 8 (All versions < V8.18.13), Mendix Applications using Mendix 9 (All versions < V9.6.2). Applications built with affected versions of Mendix Studio Pro do not properly control write access for certain client actions. This could allow authenticated attackers to manipulate the content of System.FileDocument objects in some cases, regardless whether they have write access to it.

CVSS v3 6.5 MEDIUM
CVSS v2.0 6.8 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:N/I:C/A:N

Exploitability : 8.0 / Impact : 6.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact COMPLETE

Availability Impact NONE

References

Link	Resource
https://cert-portal.siemens.com/productcert/pdf/ssa-779699.pdf	Patch Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-779699.pdf	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mendix:mendix::::::::
	cpe:2.3:a:mendix:mendix::::::::

History

21 Nov 2024, 06:27

Type	Values Removed	Values Added
References	~~() https://cert-portal.siemens.com/productcert/pdf/ssa-779699.pdf - Patch, Vendor Advisory~~	() https://cert-portal.siemens.com/productcert/pdf/ssa-779699.pdf - Patch, Vendor Advisory

Information

Published : 2021-11-09 12:15

Updated : 2024-11-21 06:27

NVD link : CVE-2021-42025

Mitre link : CVE-2021-42025

CVE.ORG link : CVE-2021-42025

JSON object : View

Products Affected

mendix

mendix

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2021-42025", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:N/I:C/A:N", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 6.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2021-11-09T12:15:10.587", "references": [{"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-779699.pdf", "tags": ["Patch", "Vendor Advisory"], "source": "productcert@siemens.com"}, {"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-779699.pdf", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "productcert@siemens.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in Mendix Applications using Mendix 8 (All versions < V8.18.13), Mendix Applications using Mendix 9 (All versions < V9.6.2). Applications built with affected versions of Mendix Studio Pro do not properly control write access for certain client actions. This could allow authenticated attackers to manipulate the content of System.FileDocument objects in some cases, regardless whether they have write access to it."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad en las aplicaciones de Mendix usadas en Mendix versi\u00f3n 8 (Todas las versiones anteriores a V8.18.13), aplicaciones de Mendix usadas en Mendix versi\u00f3n 9 (Todas las versiones anteriores a V9.6.2). Las aplicaciones construidas con las versiones afectadas de Mendix Studio Pro no controlan apropiadamente el acceso de escritura para determinadas acciones del cliente. Esto podr\u00eda permitir a atacantes autenticados manipular el contenido de los objetos System.FileDocument en algunos casos, independientemente de que tengan acceso de escritura"}], "lastModified": "2024-11-21T06:27:06.407", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mendix:mendix:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "77846974-E401-4C9A-8546-6C0F58F84010", "versionEndExcluding": "8.18.13", "versionStartIncluding": "8.0.0"}, {"criteria": "cpe:2.3:a:mendix:mendix:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CD6DC146-2C4D-4CA2-BAB6-C74D3669A439", "versionEndExcluding": "9.6.2", "versionStartIncluding": "9.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "productcert@siemens.com"}