Mendix vulnerabilities

We track 11 vulnerabilities in Mendix products across 3 products. 11 are rated high or critical, and none are known to be exploited. The most recent was published on June 13, 2023.

11vulnerabilities

5critical

6high

0exploited

8.6average CVSS score

Latest Mendix vulnerabilities

9.8 Critical severity
Mendix SAML (Mendix 7 compatible): Improper Authentication
CVE-2023-29129Jun 13, 2023Siemens
A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.17.3 < V1.18.0), Mendix SAML (Mendix 7 compatible) (All versions >= V1.16.4 < V1.17.3), Mendix SAML (Mendix 8 compatible) (All versions >= V2.3.0 < V2.4.0), Mendix SAM
7.5 High severity
Mendix SAML (Mendix 7 compatible): Improper Authentication
CVE-2023-25957Mar 14, 2023Siemens
A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.16.4 < V1.17.3), Mendix SAML (Mendix 8 compatible) (All versions >= V2.2.0 < V2.3.0), Mendix SAML (Mendix 9 latest compatible, New Track) (All versions >= V3.1.9 < V3.
7.5 High severity
Mendix Applications using Mendix 7: Improper Access Control
CVE-2023-23835Feb 14, 2023Siemens
A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.34), Mendix Applications using Mendix 8 (All versions < V8.18.23), Mendix Applications using Mendix 9 (All versions < V9.22.0), Mendix Applications using Mendix 9 (
9.8 Critical severity
Mendix SAML (Mendix 7 compatible): Authentication Bypass by Capture-replay
CVE-2022-44457Nov 8, 2022Siemens
A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions < V1.17.0), Mendix SAML (Mendix 7 compatible) (All versions >= V1.17.0 < V1.17.2), Mendix SAML (Mendix 8 compatible) (All versions < V2.3.0), Mendix SAML (Mendix 8 compatibl
9.8 Critical severity
Mendix SAML (Mendix 7 compatible): Authentication Bypass by Capture-replay
CVE-2022-37011Sep 13, 2022SiemensEPSS 1.26%
A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions < V1.17.0), Mendix SAML (Mendix 8 compatible) (All versions < V2.3.0), Mendix SAML (Mendix 9 compatible, New Track) (All versions < V3.3.1), Mendix SAML (Mendix 9 compatible
7.5 High severity
Mendix Applications using Mendix 7: Improper Access Control
CVE-2022-31257Jul 12, 2022Siemens
A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.31), Mendix Applications using Mendix 8 (All versions < V8.18.18), Mendix Applications using Mendix 9 (All versions < V9.14.0), Mendix Applications using Mendix 9 (
7.5 High severity
Mendix SAML Module (Mendix 7 compatible): Improper Restriction of XML External Entity Reference
CVE-2022-32285Jun 14, 2022SiemensEPSS 1.04%
A vulnerability has been identified in Mendix SAML Module (Mendix 7 compatible) (All versions < V1.16.6), Mendix SAML Module (Mendix 8 compatible) (All versions < V2.2.2), Mendix SAML Module (Mendix 9 compatible) (All versions < V3.2.3). The affected module is
7.5 High severity
Mendix Applications using Mendix 7: Exposure of Sensitive Information to an Unauthorized Actor
CVE-2022-27241Apr 12, 2022SiemensEPSS 1.38%
A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.31), Mendix Applications using Mendix 8 (All versions < V8.18.18), Mendix Applications using Mendix 9 (All versions < V9.11), Mendix Applications using Mendix 9 (V9
9.8 Critical severity
Mendix Forgot Password Appstore module: Improper Restriction of Excessive Authentication Attempts
CVE-2022-26314Mar 8, 2022SiemensEPSS 1.49%
A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions >= V3.3.0 < V3.5.1), Mendix Forgot Password Appstore module (Mendix 7 compatible) (All versions < V3.2.2). Initial passwords are generated in an insecure manner. This c
9.8 Critical severity
Mendix Forgot Password Appstore module: Improper Access Control
CVE-2022-26313Mar 8, 2022Siemens
A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions >= V3.3.0 < V3.5.1). In certain configurations of the affected product, a threat actor could use the sign up flow to hijack arbitrary user accounts.
8.1 High severity
Mendix Runtime V7: Improper Access Control
CVE-2022-24309Mar 8, 2022Siemens
A vulnerability has been identified in Mendix Runtime V7 (All versions < V7.23.29), Mendix Runtime V8 (All versions < V8.18.16), Mendix Runtime V9 (All versions < V9.13 only with Runtime Custom Setting *DataStorage.UseNewQueryHandler* set to False). If an enti