CVE-2022-26317: Medium severity mendix vulnerability
A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.29). When returning the result of a completed Microflow execution call the affected framework does not correctly verify, if the request was initially made by the user requesting the result. Together with predictable identifiers for Microflow execution calls, this could allow a malicious attacker to retrieve information about arbitrary Microflow execution calls made by users within the affected system.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-26317?
The severity of CVE-2022-26317 is medium with a score of 6.5.
Which Mendix versions are affected by CVE-2022-26317?
All versions of Mendix 7 below V7.23.29 are affected by CVE-2022-26317.
What is the vulnerability in Mendix Applications described in CVE-2022-26317?
CVE-2022-26317 is a vulnerability in Mendix Applications where the affected framework does not correctly verify the initial user request when returning the result of a completed Microflow execution call.
How can I fix CVE-2022-26317 in my Mendix Application?
To fix CVE-2022-26317, update your Mendix 7 version to V7.23.29 or above.
Where can I find more information about CVE-2022-26317?
You can find more information about CVE-2022-26317 in the following reference document: [Link](https://cert-portal.siemens.com/productcert/pdf/ssa-415938.pdf).