Summary
Mendix SAML module contains a vulnerability that could allow unauthenticated remote attackers to hijack an account in specific SSO configurations.
Mendix has provided fix releases for the Mendix SAML module and recommends to update to the latest version.
Vulnerabilities 1
-
High 8.7
A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), Mendix SAML (Mendix …
Revision history
-
#4
CISA Republication update based on Siemens ProductCERT SSA-887643 advisory
-
#3
Released new fixed versions, as the previous versions did not fully remediate the vulnerability.
-
#2
CISA Republication - Initial CISA Republication of Siemens ProductCERT SSA-887643 advisory
-
#1
Publication Date
References
-
SSA-887643: Account Hijacking Vulnerability in Mendix SAML module - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-887643.html
-
ICS Advisory icsa-26-258-06 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-06
-
Recommended Practices
https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b