SSA-638652 V1.2 (Last Update: 2022-12-13): Authentication Bypass Vulnerability in Mendix SAML Module

Risk Summary

<p>The Mendix SAML module insufficiently protects from packet capture replay. This could allow unauthorized remote attackers to bypass authentication and get access to the application.</p> <p>Mendix has provided fix releases for the Mendix SAML module and recommends to update to the latest version.</p> <p>Note: For compatibility reasons, fix versions are introduced in two release steps:</p> <ul> <li>The first fix versions address CVE-2022-37011. It removes the vulnerability, except when the not recommended, non default configuration option <code>'Allow Idp Initiated Authentication'</code> is enabled.</li> <li>The second fix versions address CVE-2022-44457, which removes the issue for the non default configuration as well.</li> </ul>

CVEs (2)

Remediations

• Refer to Siemens ProductCERT advisory for patch and remediation guidance.

Affected Vendors

Affected Products (1)