CVE-2022-37011

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions < V1.17.0), Mendix SAML (Mendix 8 compatible) (All versions < V2.3.0), Mendix SAML (Mendix 9 compatible, New Track) (All versions < V3.3.1), Mendix SAML (Mendix 9 compatible, Upgrade Track) (All versions < V3.3.0). Affected versions of the module insufficiently protect from packet capture replay. This could allow unauthorized remote attackers to bypass authentication and get access to the application. For compatibility reasons, fix versions still contain this issue, but only when the not recommended, non default configuration option `'Allow Idp Initiated Authentication'` is enabled.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-294

Affected software

Vendor	Product	Versions
Siemens	Mendix SAML (Mendix 7 compatible)	All versions < V1.17.0
Siemens	Mendix SAML (Mendix 8 compatible)	All versions < V2.3.0
Siemens	Mendix SAML (Mendix 9 compatible, New Track)	All versions < V3.3.1
Siemens	Mendix SAML (Mendix 9 compatible, Upgrade Track)	All versions < V3.3.0

References

https://cert-portal.siemens.com/productcert/pdf/ssa-638652.pdfPatch, Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-638652.pdfPatch, Third Party Advisory

Timeline

Published: Sep 13, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-370127.5This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Unified Automation OPC UA C+CVE-2022-370137.5This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Unified Automation OPC UA C+CVE-2022-370159.8Symantec Endpoint Detection and Response (SEDR) Appliance, prior to 4.7.0, may be susceptible to a privilege escalation vulnerability, which CVE-2022-370169.8Symantec Endpoint Protection (Windows) agent may be susceptible to a Privilege Escalation vulnerability, which is a type of issue whereby an CVE-2022-370177.5Symantec Endpoint Protection (Windows) agent, prior to 14.3 RU6/14.3 RU5 Patch 1, may be susceptible to a Security Control Bypass vulnerabil CVE-2022-370188.4A potential vulnerability has been identified in the system BIOS for certain HP PC products which may allow escalation of privileges and cod CVE-2022-370196.8Potential vulnerabilities have been identified in the system BIOS for certain HP PC products which may allow escalation of privileges and co CVE-2022-37027.1A denial of service vulnerability was reported in Lenovo Vantage HardwareScan Plugin version 1.3.0.5 and earlier that could allow a local at CVE-2022-370206.8Potential vulnerabilities have been identified in the system BIOS for certain HP PC products, which might allow escalation of privileges and CVE-2022-370219.8Apache Geode versions up to 1.12.5, 1.13.4 and 1.14.0 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on CVE-2022-370228.8Apache Geode versions up to 1.12.2 and 1.13.2 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 11.CVE-2022-370236.5Apache Geode versions prior to 1.15.0 are vulnerable to a deserialization of untrusted data flaw when using REST API on Java 8 or Java 11. A