A vulnerability has been identified in Mendix Runtime V7 (All versions < V7.23.29), Mendix Runtime V8 (All versions < V8.18.16), Mendix Runtime V9 (All versions < V9.13 only with Runtime Custom Setting *DataStorage.UseNewQueryHandler* set to False). If an entity has an association readable by the user, then in some cases, Mendix Runtime may not apply checks for XPath constraints that parse said associations, within apps running on affected versions. A malicious user could use this to dump and manipulate sensitive data.
References
| Link | Resource |
|---|---|
| https://cert-portal.siemens.com/productcert/html/ssa-148641.html | |
| https://cert-portal.siemens.com/productcert/pdf/ssa-148641.pdf | Mitigation Release Notes Vendor Advisory |
| https://cert-portal.siemens.com/productcert/html/ssa-148641.html | |
| https://cert-portal.siemens.com/productcert/pdf/ssa-148641.pdf | Mitigation Release Notes Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 06:50
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://cert-portal.siemens.com/productcert/html/ssa-148641.html - | |
| References | () https://cert-portal.siemens.com/productcert/pdf/ssa-148641.pdf - Mitigation, Release Notes, Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : 4.9
v3 : 6.8 |
08 Oct 2024, 09:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) A vulnerability has been identified in Mendix Runtime V7 (All versions < V7.23.29), Mendix Runtime V8 (All versions < V8.18.16), Mendix Runtime V9 (All versions < V9.13 only with Runtime Custom Setting *DataStorage.UseNewQueryHandler* set to False). If an entity has an association readable by the user, then in some cases, Mendix Runtime may not apply checks for XPath constraints that parse said associations, within apps running on affected versions. A malicious user could use this to dump and manipulate sensitive data. |
14 May 2024, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
| Summary | (en) A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.29), Mendix Applications using Mendix 8 (All versions < V8.18.16), Mendix Applications using Mendix 9 (All versions < V9.13 only with Runtime Custom Setting *DataStorage.UseNewQueryHandler* set to False). If an entity has an association readable by the user, then in some cases, Mendix Runtime may not apply checks for XPath constraints that parse said associations, within apps running on affected versions. A malicious user could use this to dump and manipulate sensitive data. |
30 Jun 2023, 18:47
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | NVD-CWE-Other |
Information
Published : 2022-03-08 12:15
Updated : 2024-11-21 06:50
NVD link : CVE-2022-24309
Mitre link : CVE-2022-24309
CVE.ORG link : CVE-2022-24309
JSON object : View
Products Affected
mendix
- mendix
CWE