Siemens Mendix SAML (Mendix 7 compatible)

CVE-2022-44457

CRITICAL 9.8

En bref

Source: NVD
EPSS: EPSS 0.76 % · centile 55 (2026-11-01)
État: PUBLISHED
Publiée: 2022-11-08 00:00 UTC
Mise à jour: 2025-05-01 18:07 UTC
Attribuée par: siemens
Statut NVD: Modified

Rechercher sur…

Description

A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions < V1.17.0), Mendix SAML (Mendix 7 compatible) (All versions >= V1.17.0 < V1.17.2), Mendix SAML (Mendix 8 compatible) (All versions < V2.3.0), Mendix SAML (Mendix 8 compatible) (All versions >= V2.3.0 < V2.3.2), Mendix SAML (Mendix 9 compatible, New Track) (All versions < V3.3.1), Mendix SAML (Mendix 9 compatible, New Track) (All versions >= V3.3.1 < V3.3.5), Mendix SAML (Mendix 9 compatible, Upgrade Track) (All versions < V3.3.0), Mendix SAML (Mendix 9 compatible, Upgrade Track) (All versions >= V3.3.0 < V3.3.4). Affected versions of the module insufficiently protect from packet capture replay, only when the not recommended, non default configuration option `'Allow Idp Initiated Authentication'` is enabled. This CVE entry describes the incomplete fix for CVE-2022-37011 in a specific non default configuration.

Faiblesses (CWE)

CWE-294 — Contournement d'authentification par capture et rejeu

Références

https://cert-portal.siemens.com/productcert/pdf/ssa-638652.pdf

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	CRITICAL 9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CISA-ADP
CVSS 3.1	CRITICAL 9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	NVD · nvd@nist.gov (Primary)
CVSS 3.1	CRITICAL 9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Références européennes

ENISA EUVD · EUVD-2022-47400
GCVE · GCVE-0-2022-44457

Configurations affectées (CPE NVD)

cpe:2.3:a:mendix:saml:*:*:*:*:*:*:*:* < 1.17.0
cpe:2.3:a:mendix:saml:*:*:*:*:*:*:*:* ≥ 2.3.0 < 2.3.2
cpe:2.3:a:mendix:saml:*:*:*:*:*:*:*:* ≥ 3.3.0 < 3.3.4

Produits affectés

Produit	Versions
Siemens · Mendix SAML (Mendix 7 compatible)	affected All versions < V1.17.0
Siemens · Mendix SAML (Mendix 7 compatible)	affected All versions >= V1.17.0 < V1.17.2
Siemens · Mendix SAML (Mendix 8 compatible)	affected All versions < V2.3.0
Siemens · Mendix SAML (Mendix 8 compatible)	affected All versions >= V2.3.0 < V2.3.2
Siemens · Mendix SAML (Mendix 9 compatible, New Track)	affected All versions < V3.3.1
Siemens · Mendix SAML (Mendix 9 compatible, New Track)	affected All versions >= V3.3.1 < V3.3.5
Siemens · Mendix SAML (Mendix 9 compatible, Upgrade Track)	affected All versions < V3.3.0
Siemens · Mendix SAML (Mendix 9 compatible, Upgrade Track)	affected All versions >= V3.3.0 < V3.3.4

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

💣 Siemens Mendix SAML (Mendix 7 compatible)