Siemens Mendix Applications using Mendix 8
At a glance
- Source
- NVD
- EPSS
- EPSS 0.58 % · percentile 48 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- siemens
- NVD status
- Modified
Description
A vulnerability has been identified in Mendix Applications using Mendix 8 (All versions < V8.18.13), Mendix Applications using Mendix 9 (All versions < V9.6.2). Applications built with affected versions of Mendix Studio Pro do not properly control write access for certain client actions. This could allow authenticated attackers to manipulate the content of System.FileDocument objects in some cases, regardless whether they have write access to it.
Weaknesses (CWE)
- CWE-863 — Incorrect Authorization
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 6.8 | AV:N/AC:L/Au:S/C:N/I:C/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2021-29013
- GCVE · GCVE-0-2021-42025
CERT-FR advisories
- CERTFR-2021-AVI-854 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:mendix:mendix:*:*:*:*:*:*:*:*≥ 8.0.0 < 8.18.13cpe:2.3:a:mendix:mendix:*:*:*:*:*:*:*:*≥ 9.0.0 < 9.6.2
Affected products
| Product | Versions |
|---|---|
| Siemens · Mendix Applications using Mendix 8 | affected All versions < V8.18.13 |
| Siemens · Mendix Applications using Mendix 9 | affected All versions < V9.6.2 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |