CVE-2022-26317

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.29). When returning the result of a completed Microflow execution call the affected framework does not correctly verify, if the request was initially made by the user requesting the result. Together with predictable identifiers for Microflow execution calls, this could allow a malicious attacker to retrieve information about arbitrary Microflow execution calls made by users within the affected system.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-284 CWE-330

Affected software

No affected versions have been published.

Timeline

Published: Mar 8, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-263189.8On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. This vulnerability impacts Fire CVE-2022-263196.5An installer search patch element vulnerability in Trend Micro Portable Security 3.0 Pro, 3.0 and 2.0 could allow a local attacker to place CVE-2022-263209.1The Rambus SafeZone Basic Crypto Module before 10.4.0, as used in certain Fujifilm (formerly Fuji Xerox) devices before 2022-03-01, Canon im CVE-2022-263227.5Possible Insertion of Sensitive Information into Log File Vulnerability in Identity Manager has been discovered in OpenText™ Identity Mana CVE-2022-263238.7Incorrect Use of Privileged APIs vulnerability in OpenText™ Operations Bridge Manager, OpenText™ Operations Bridge Suite (Containerized), Op CVE-2022-263245.4Possible XSS in iManager URL for access Component has been discovered in OpenText™ iManager 3.2.6.0000.CVE-2022-263256.1Reflected Cross Site Scripting (XSS) vulnerability in NetIQ Access Manager prior to 5.0.2 CVE-2022-263266.1Potential open redirection vulnerability when URL is crafted in specific format in NetIQ Access Manager prior to 5.0.2 CVE-2022-263275.1Exposure of Sensitive Information to an Unauthorized Actor vulnerability in OpenText Performance Center on Windows allows Retrieve Embedded CVE-2022-263282.0Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText Performance Center on CVE-2022-263295.3File existence disclosure vulnerability in NetIQ Identity Manager plugin prior to version 4.8.5 allows attacker to determine whether a file CVE-2022-26338.2The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side request forgery via the 'd