Skip to content
OpenAdvisories
High SSA-638652 2 CVEs

SSA-638652: Authentication Bypass Vulnerability in Mendix SAML Module

Published Sep 13, 2022 · Updated Dec 13, 2022 · Revision 3

Vendor: Siemens Product: Mendix SAML (Mendix 7 compatible) Product: Mendix SAML (Mendix 8 compatible) Product: Mendix SAML (Mendix 9 compatible, New Track) Product: Mendix SAML (Mendix 9 compatible, Upgrade Track)

Summary

The Mendix SAML module insufficiently protects from packet capture replay. This could allow unauthorized remote attackers to bypass authentication and get access to the application.

Mendix has provided fix releases for the Mendix SAML module and recommends to update to the latest version.

Note: For compatibility reasons, fix versions are introduced in two release steps:

- The first fix versions address CVE-2022-37011. It removes the vulnerability, except when the not recommended, non default configuration option 'Allow Idp Initiated Authentication' is enabled.
- The second fix versions address CVE-2022-44457, which removes the issue for the non default configuration as well.

Vulnerabilities 2

Revision history

  1. #3

    Added fix for CVE-2022-44457 for the Mendix 7 compatible version

  2. #2

    Added CVE-2022-44457 and the fix information also for non default configurations

  3. #1

    Publication Date

References