CVE-2022-27241: Infoleak
First published: Tue Apr 12 2022(Updated: )
A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.31), Mendix Applications using Mendix 8 (All versions < V8.18.18), Mendix Applications using Mendix 9 (All versions < V9.11), Mendix Applications using Mendix 9 (V9.6) (All versions < V9.6.12). Applications built with an affected system publicly expose the internal project structure. This could allow an unauthenticated remote attacker to read confidential information.
Credit: productcert@siemens.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mendix | >=7.0.0<9.11.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2022-27241?
The severity of CVE-2022-27241 is high with a CVSS score of 7.5.
Which versions of Mendix Applications are affected by CVE-2022-27241?
All versions of Mendix 7 < V7.23.31, Mendix 8 < V8.18.18, and Mendix 9 < V9.11 are affected by CVE-2022-27241.
How can I fix CVE-2022-27241?
To fix CVE-2022-27241, upgrade Mendix Applications to V7.23.31 or above for Mendix 7, V8.18.18 or above for Mendix 8, and V9.11 or above for Mendix 9.
What is the Common Weakness Enumeration (CWE) ID for CVE-2022-27241?
The Common Weakness Enumeration (CWE) ID for CVE-2022-27241 is 200.
Where can I find more information about CVE-2022-27241?
More information about CVE-2022-27241 can be found in the advisory at: [https://cert-portal.siemens.com/productcert/pdf/ssa-414513.pdf](https://cert-portal.siemens.com/productcert/pdf/ssa-414513.pdf).
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/weakness
- agent/remedy
- agent/last-modified-date
- agent/author
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/mendix
- canonical/mendix
- version/mendix/7.0.0