CVE-2022-37011CWE-294

CVE-2022-37011: vulnerability in Siemens Mendix SAML (Mendix 7 compatible)

Published · Updated

Follow this CVE+ Monitor Mendix SAML

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 1.2%
A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions < V1.17.0), Mendix SAML (Mendix 8 compatible) (All versions < V2.3.0), Mendix SAML (Mendix 9 compatible, New Track) (All versions < V3.3.1), Mendix SAML (Mendix 9 compatible, Upgrade Track) (All versions < V3.3.0). Affected versions of the module insufficiently protect from packet capture replay. This could allow unauthorized remote attackers to bypass authentication and get access to the application. For compatibility reasons, fix versions still contain this issue, but only when the not recommended, non default configuration option `'Allow Idp Initiated Authentication'` is enabled.
Affected products
Siemens · Mendix SAML (Mendix 7 compatible)Siemens · Mendix SAML (Mendix 8 compatible)Siemens · Mendix SAML (Mendix 9 compatible, New Track)Siemens · Mendix SAML (Mendix 9 compatible, Upgrade Track)
Related CVEs — Siemens Mendix SAML (Mendix 7 compatible)

In the same product, most dangerous first.

CVE-2023-29129CRITICALCVE-2023-29129EPSS 0.9%CVE-2022-44457CRITICALCVE-2022-44457EPSS 0.8%CVE-2023-25957CRITICALCVE-2023-25957EPSS 0.6%CVE-2022-46823CRITICALCVE-2022-46823EPSS 0.5%