CVE-2022-26313: Critical severity mendix vulnerability
A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions >= V3.3.0 < V3.5.1). In certain configurations of the affected product, a threat actor could use the sign up flow to hijack arbitrary user accounts.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-26313?
CVE-2022-26313 is a vulnerability identified in the Mendix Forgot Password Appstore module (versions >= V3.3.0 < V3.5.1).
What is the severity of CVE-2022-26313?
CVE-2022-26313 has a severity rating of 9.8 (Critical).
How does CVE-2022-26313 impact the affected product?
CVE-2022-26313 allows a threat actor to hijack arbitrary user accounts by exploiting certain configurations in the sign-up flow of the Mendix Forgot Password module.
Which versions of the Mendix Forgot Password module are affected by CVE-2022-26313?
Versions >= V3.3.0 and < V3.5.1 of the Mendix Forgot Password module are affected by CVE-2022-26313.
How can I fix CVE-2022-26313 vulnerability?
To fix the CVE-2022-26313 vulnerability, update the Mendix Forgot Password module to a version higher than or equal to V3.5.1.