// For flags

CVE-2022-26317

 

Severity Score

6.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.29). When returning the result of a completed Microflow execution call the affected framework does not correctly verify, if the request was initially made by the user requesting the result. Together with predictable identifiers for Microflow execution calls, this could allow a malicious attacker to retrieve information about arbitrary Microflow execution calls made by users within the affected system.

Se ha identificado una vulnerabilidad en las aplicaciones de Mendix usadas en Mendix 7 (Todas las versiones anteriores a V7.23.29). Cuando es devuelto el resultado de una llamada de ejecución de Microflow completada, el framework afectado no verifica correctamente, si la petición fue realizada inicialmente por el usuario que solicita el resultado. Junto con los identificadores predecibles para las llamadas de ejecución de Microflow, esto podría permitir a un atacante malicioso recuperar información sobre llamadas de ejecución de Microflow arbitrarias realizadas por usuarios dentro del sistema afectado

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-02-28 CVE Reserved
  • 2022-03-08 CVE Published
  • 2023-09-29 EPSS Updated
  • 2024-08-03 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-284: Improper Access Control
  • CWE-330: Use of Insufficiently Random Values
CAPEC
References (1)
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Mendix
Search vendor "Mendix"
Mendix
Search vendor "Mendix" for product "Mendix"
< 7.23.29
Search vendor "Mendix" for product "Mendix" and version " < 7.23.29"
-
Affected