// For flags

CVE-2022-44457

 

Severity Score

9.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions < V1.17.0), Mendix SAML (Mendix 7 compatible) (All versions >= V1.17.0 < V1.17.2), Mendix SAML (Mendix 8 compatible) (All versions < V2.3.0), Mendix SAML (Mendix 8 compatible) (All versions >= V2.3.0 < V2.3.2), Mendix SAML (Mendix 9 compatible, New Track) (All versions < V3.3.1), Mendix SAML (Mendix 9 compatible, New Track) (All versions >= V3.3.1 < V3.3.5), Mendix SAML (Mendix 9 compatible, Upgrade Track) (All versions < V3.3.0), Mendix SAML (Mendix 9 compatible, Upgrade Track) (All versions >= V3.3.0 < V3.3.4). Affected versions of the module insufficiently protect from packet capture replay, only when the not recommended, non default configuration option `'Allow Idp Initiated Authentication'` is enabled. This CVE entry describes the incomplete fix for CVE-2022-37011 in a specific non default configuration.

Se ha identificado una vulnerabilidad en Mendix SAML (compatible con Mendix 7) (Todas las versiones &lt; V1.17.0),
Mendix SAML (compatible con Mendix 7) (Todas las versiones &gt;= V1.17.0 &lt; V1.17.2),
Mendix SAML (Mendix 8 compatible) (Todas las versiones &lt; V2.3.0),
Mendix SAML (compatible con Mendix 8) (Todas las versiones &gt; V2.3.0 &lt; V2.3.2),
Mendix SAML (compatible con Mendix 9, New Track) (Todas las versiones &lt; V3.3.1),
Mendix SAML (compatible con Mendix 9, New Track) (todas las versiones &gt;= V3.3.1 &lt; V3.3.5),
Mendix SAML (compatible con Mendix 9, Upgrade Track) (todas las versiones &lt; V3.3.0 ),
Mendix SAML (compatible con Mendix 9, Upgrade Track) (Todas las versiones &gt; V3.3.0 y &lt; V3.3.4).
Las versiones afectadas del módulo no protegen suficientemente contra la reproducción de captura de paquetes, solo cuando la opción de configuración no predeterminada y no recomendada ""Permitir Autenticación Iniciada por Idp"" está habilitada. Esta entrada de CVE describe la solución incompleta para CVE-2022-37011 en una configuración específica no predeterminada.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-10-31 CVE Reserved
  • 2022-11-08 CVE Published
  • 2024-05-31 EPSS Updated
  • 2024-08-03 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-294: Authentication Bypass by Capture-replay
CAPEC
References (1)
URL Tag Source
URL Date SRC
URL Date SRC
https://cert-portal.siemens.com/productcert/pdf/ssa-638652.pdf 2022-12-13
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Mendix
Search vendor "Mendix"
 Saml
Search vendor "Mendix" for product "Saml"
 < 1.17.0
Search vendor "Mendix" for product "Saml" and version " < 1.17.0"
-
Affected
Mendix
Search vendor "Mendix"
 Saml
Search vendor "Mendix" for product "Saml"
 >= 2.3.0 < 2.3.2
Search vendor "Mendix" for product "Saml" and version " >= 2.3.0 < 2.3.2"
-
Affected
Mendix
Search vendor "Mendix"
 Saml
Search vendor "Mendix" for product "Saml"
 >= 3.3.0 < 3.3.4
Search vendor "Mendix" for product "Saml" and version " >= 3.3.0 < 3.3.4"
-
Affected