NewsSiemens ProductCERT

SSA-638652 V1.0: Authentication Bypass Vulnerability in Mendix SAML Module

The Mendix SAML module insufficiently protects from packet capture replay. This could allow unauthorized remote attackers to bypass authentication and get access to the application. Mendix has provided fix releases for the Mendix SAML module and recommends to update to the latest version. Note: For compatibility reasons, fix versions still contain this issue, but only when the not recommended, non default configuration option 'Allow Idp Initiated Authentication' is enabled.

CVE-2022-44457Eine Schwachstelle wurde in Mendix SAML (Mendix 7 kompatibel) (Alle Versionen < V1.
CVE-2022-44457Siemens Mendix SAML (Mendix 7 compatible): Umgehung der Authentifizierung durch Replay
CVE-2022-37011Siemens Mendix SAML (Mendix 7 compatible): Umgehung der Authentifizierung durch Replay
CVE-2022-37011Siemens ProductCERT Advisory SSA-638652
CVE-2022-37011Eine Schwachstelle wurde in Mendix SAML (Mendix 7 kompatibel) (Alle Versionen < V1.

Affected vendors and products

Siemens Siemens Mendix SAML Module
Siemens Mendix Saml (mendix 7 Compatible)
Siemens Mendix Saml (mendix 8 Compatible)
Siemens Mendix Saml (mendix 9 Compatible, New Track)
Siemens Mendix Saml (mendix 9 Compatible, Upgrade Track)

Other advisories

CriticalCVE-2022-37011Siemens ProductCERT Advisory SSA-638652

Source: https://cert-portal.siemens.com/productcert/pdf/ssa-638652.pdf

Linked advisories

Affected vendors and products

More on SSA-638652

Other advisories