Riskcovery

CVE-2022-37011

State
Published
Severity
Not scored
Published
Sep 13, 2022
Updated
Aug 3, 2024
Reserved
Jul 28, 2022

Read the record on cve.org

Description

A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions < V1.17.0), Mendix SAML (Mendix 8 compatible) (All versions < V2.3.0), Mendix SAML (Mendix 9 compatible, New Track) (All versions < V3.3.1), Mendix SAML (Mendix 9 compatible, Upgrade Track) (All versions < V3.3.0). Affected versions of the module insufficiently protect from packet capture replay. This could allow unauthorized remote attackers to bypass authentication and get access to the application. For compatibility reasons, fix versions still contain this issue, but only when the not recommended, non default configuration option `'Allow Idp Initiated Authentication'` is enabled.

Scores

The record has no CVSS score.

Weaknesses

  • CWE-294 Authentication Bypass by Capture-replay

Affected Products

ProductVersions
Mendix SAML (Mendix 7 compatible)Siemens
  • All versions < V1.17.0Affected
Mendix SAML (Mendix 8 compatible)Siemens
  • All versions < V2.3.0Affected
Mendix SAML (Mendix 9 compatible, New Track)Siemens
  • All versions < V3.3.1Affected
Mendix SAML (Mendix 9 compatible, Upgrade Track)Siemens
  • All versions < V3.3.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.