Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2022-26313 (GCVE-0-2022-26313)
Vulnerability from cvelistv5
- CWE-284 - Improper Access Control
URL | Tags | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
|
Vendor | Product | Version | ||
---|---|---|---|---|
Siemens | Mendix Forgot Password Appstore module |
Version: All versions >= V3.3.0 < V3.5.1 |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-03T05:03:31.844Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-134279.pdf" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "Mendix Forgot Password Appstore module", "vendor": "Siemens", "versions": [ { "status": "affected", "version": "All versions \u003e= V3.3.0 \u003c V3.5.1" } ] } ], "descriptions": [ { "lang": "en", "value": "A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions \u003e= V3.3.0 \u003c V3.5.1). In certain configurations of the affected product, a threat actor could use the sign up flow to hijack arbitrary user accounts." } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-284", "description": "CWE-284: Improper Access Control", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2022-03-08T11:31:34", "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "shortName": "siemens" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-134279.pdf" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "productcert@siemens.com", "ID": "CVE-2022-26313", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "Mendix Forgot Password Appstore module", "version": { "version_data": [ { "version_value": "All versions \u003e= V3.3.0 \u003c V3.5.1" } ] } } ] }, "vendor_name": "Siemens" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions \u003e= V3.3.0 \u003c V3.5.1). In certain configurations of the affected product, a threat actor could use the sign up flow to hijack arbitrary user accounts." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-284: Improper Access Control" } ] } ] }, "references": { "reference_data": [ { "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-134279.pdf", "refsource": "MISC", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-134279.pdf" } ] } } } }, "cveMetadata": { "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "assignerShortName": "siemens", "cveId": "CVE-2022-26313", "datePublished": "2022-03-08T11:31:34", "dateReserved": "2022-02-28T00:00:00", "dateUpdated": "2024-08-03T05:03:31.844Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2022-26313\",\"sourceIdentifier\":\"productcert@siemens.com\",\"published\":\"2022-03-08T12:15:11.777\",\"lastModified\":\"2024-11-21T06:53:44.287\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions \u003e= V3.3.0 \u003c V3.5.1). In certain configurations of the affected product, a threat actor could use the sign up flow to hijack arbitrary user accounts.\"},{\"lang\":\"es\",\"value\":\"Se ha identificado una vulnerabilidad en el m\u00f3dulo Mendix Forgot Password Appstore (Todas las versiones posteriores a V3.3.0 incluy\u00e9ndola, anteriores a V3.5.1). En determinadas configuraciones del producto afectado, un actor de amenaza podr\u00eda usar el flujo de registro para secuestrar cuentas de usuario arbitrarias\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:P/I:P/A:P\",\"baseScore\":6.8,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"productcert@siemens.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-284\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mendix:forgot_password:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.3.0\",\"versionEndExcluding\":\"3.5.1\",\"matchCriteriaId\":\"394B806B-A2A7-4BA4-B7DC-08756FA27908\"}]}]}],\"references\":[{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-134279.pdf\",\"source\":\"productcert@siemens.com\",\"tags\":[\"Mitigation\",\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-134279.pdf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mitigation\",\"Patch\",\"Vendor Advisory\"]}]}}" } }
CERTFR-2022-AVI-216
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits Siemens. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
- Mendix Forgot Password Appstore module versions 3.2.x antérieures à 3.2.2
- Mendix Forgot Password Appstore module versions 3.3.x à 3.5.x antérieures à 3.5.1
- Mendix Applications utilisant Mendix versions 7.x antérieures à 7.23.29
- Mendix Applications utilisant Mendix versions 8.x antérieures à 8.18.16
- COMOS versions antérieures à 10.4.1
- Simcenter STAR-CCM+ Viewer versions antérieures à V2022.1
- SIMOTICS CONNECT 400 versions antérieures à 1.0.0.0
- Climatix POL909 (module AWB) versions antérieures à 11.44
- Climatix POL909 (module AWM) versions antérieures à 11.36
- RUGGEDCOM ROS M2100, RMC8388, RS416v2, RS900G, RS900G (32M), RSG900, RSG920P, RSG2100 (32M), RSG2100P, RSG2100P (32M), RSG2288, RSG2300, RSG2300P, RSG2488, RSL910, RST916C, RST916P et RST2228 versions antérieures à 5.6.0
- SINUMERIK MC versions antérieures à 1.15 SP1
- SINUMERIK ONE versions antérieures à 6.15 SP1
- SINEC INS versions antérieures à 1.0.1.1
- RUGGEDCOM ROX MX5000, RX1400, RX1500, RX1501, RX1510, RX1511, RX1512, RX1524, RX1536 et RX5000 versions antérieures à 2.15.0
- Polarion Subversion Webclient versions antérieures à 21 R2 P2
- RUGGEDCOM ROS i800, i801, i802, i803, M969, M2100, M2200, RMC, RMC20, RMC30, RMC40, RMC41, RMC8388, RP110, RS400, RS401, RS416, RS416v2, RS900 (32M), RS900G, RS900G (32M), RS900GP, RS900L, RS900L, RS900W, RS910, RS910L, RS910W, RS920L, RS920W, RS930L, RS930W, RS940G, RS969, RS8000, RS8000A, RS8000H, RS8000T, RSG900, RSG900C, RSG900G, RSG900R, RSG907R, RSG908C, RSG909R, RSG910C, RSG920P, RSG2100, RSG2100 (32M), RSG2100P, RSG2100P (32M), RSG2200, RSG2288, RSG2300, RSG2300P, RSG2488, RSL910, RST916C, RST916P et RST2228 versions antérieures à 5.6.0
L'éditeur ne propose pas de correctif pour :
- Mendix Applications utilisant Mendix versions 9
- SINEC NMS toutes versions
Se référer aux mesures de contournement proposées dans la section Documentation.
Vendor | Product | Description |
---|
{ "$ref": "https://www.cert.ssi.gouv.fr/openapi.json", "affected_systems": [], "affected_systems_content": "\u003cul\u003e \u003cli\u003eMendix Forgot Password Appstore module versions 3.2.x ant\u00e9rieures \u00e0 3.2.2\u003c/li\u003e \u003cli\u003eMendix Forgot Password Appstore module versions 3.3.x \u00e0 3.5.x ant\u00e9rieures \u00e0 3.5.1\u003c/li\u003e \u003cli\u003eMendix Applications utilisant Mendix versions 7.x ant\u00e9rieures \u00e0 7.23.29\u003c/li\u003e \u003cli\u003eMendix Applications utilisant Mendix versions 8.x ant\u00e9rieures \u00e0 8.18.16\u003c/li\u003e \u003cli\u003eCOMOS versions ant\u00e9rieures \u00e0 10.4.1\u003c/li\u003e \u003cli\u003eSimcenter STAR-CCM+ Viewer versions ant\u00e9rieures \u00e0 V2022.1\u003c/li\u003e \u003cli\u003eSIMOTICS CONNECT 400 versions ant\u00e9rieures \u00e0 1.0.0.0\u003c/li\u003e \u003cli\u003eClimatix POL909 (module AWB) versions ant\u00e9rieures \u00e0 11.44\u003c/li\u003e \u003cli\u003eClimatix POL909 (module AWM) versions ant\u00e9rieures \u00e0 11.36\u003c/li\u003e \u003cli\u003eRUGGEDCOM ROS M2100, RMC8388, RS416v2, RS900G, RS900G (32M), RSG900, RSG920P, RSG2100 (32M), RSG2100P, RSG2100P (32M), RSG2288, RSG2300, RSG2300P, RSG2488, RSL910, RST916C, RST916P et RST2228 versions ant\u00e9rieures \u00e0 5.6.0\u003c/li\u003e \u003cli\u003eSINUMERIK MC versions ant\u00e9rieures \u00e0 1.15 SP1\u003c/li\u003e \u003cli\u003eSINUMERIK ONE versions ant\u00e9rieures \u00e0 6.15 SP1\u003c/li\u003e \u003cli\u003eSINEC INS versions ant\u00e9rieures \u00e0 1.0.1.1\u003c/li\u003e \u003cli\u003eRUGGEDCOM ROX MX5000, RX1400, RX1500, RX1501, RX1510, RX1511, RX1512, RX1524, RX1536 et RX5000 versions ant\u00e9rieures \u00e0 2.15.0\u003c/li\u003e \u003cli\u003ePolarion Subversion Webclient versions ant\u00e9rieures \u00e0 21 R2 P2\u003c/li\u003e \u003cli\u003eRUGGEDCOM ROS i800, i801, i802, i803, M969, M2100, M2200, RMC, RMC20, RMC30, RMC40, RMC41, RMC8388, RP110, RS400, RS401, RS416, RS416v2, RS900 (32M), RS900G, RS900G (32M), RS900GP, RS900L, RS900L, RS900W, RS910, RS910L, RS910W, RS920L, RS920W, RS930L, RS930W, RS940G, RS969, RS8000, RS8000A, RS8000H, RS8000T, RSG900, RSG900C, RSG900G, RSG900R, RSG907R, RSG908C, RSG909R, RSG910C, RSG920P, RSG2100, RSG2100 (32M), RSG2100P, RSG2100P (32M), RSG2200, RSG2288, RSG2300, RSG2300P, RSG2488, RSL910, RST916C, RST916P et RST2228 versions ant\u00e9rieures \u00e0 5.6.0\u003c/li\u003e \u003c/ul\u003e \u003cp\u003eL\u0027\u00e9diteur ne propose pas de correctif pour :\u003c/p\u003e \u003cul\u003e \u003cli\u003eMendix Applications utilisant Mendix versions 9\u003c/li\u003e \u003cli\u003eSINEC NMS toutes versions\u003c/li\u003e \u003c/ul\u003e \u003cp\u003eSe r\u00e9f\u00e9rer aux mesures de contournement propos\u00e9es dans la section Documentation.\u003c/p\u003e \u003cp\u003e\u0026nbsp;\u003c/p\u003e ", "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n", "cves": [ { "name": "CVE-2021-44478", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44478" }, { "name": "CVE-2021-22898", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22898" }, { "name": "CVE-2020-13871", "url": "https://www.cve.org/CVERecord?id=CVE-2020-13871" }, { "name": "CVE-2021-42017", "url": "https://www.cve.org/CVERecord?id=CVE-2021-42017" }, { "name": "CVE-2022-24282", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24282" }, { "name": "CVE-2021-25215", "url": "https://www.cve.org/CVERecord?id=CVE-2021-25215" }, { "name": "CVE-2019-19317", "url": "https://www.cve.org/CVERecord?id=CVE-2019-19317" }, { "name": "CVE-2020-8169", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8169" }, { "name": "CVE-2021-25174", "url": "https://www.cve.org/CVERecord?id=CVE-2021-25174" }, { "name": "CVE-2021-22925", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22925" }, { "name": "CVE-2021-37701", "url": "https://www.cve.org/CVERecord?id=CVE-2021-37701" }, { "name": "CVE-2021-32944", "url": "https://www.cve.org/CVERecord?id=CVE-2021-32944" }, { "name": "CVE-2019-19244", "url": "https://www.cve.org/CVERecord?id=CVE-2019-19244" }, { "name": "CVE-2021-27290", "url": "https://www.cve.org/CVERecord?id=CVE-2021-27290" }, { "name": "CVE-2021-42020", "url": "https://www.cve.org/CVERecord?id=CVE-2021-42020" }, { "name": "CVE-2020-8285", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8285" }, { "name": "CVE-2021-22901", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22901" }, { "name": "CVE-2021-22940", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22940" }, { "name": "CVE-2021-32804", "url": "https://www.cve.org/CVERecord?id=CVE-2021-32804" }, { "name": "CVE-2020-13632", "url": "https://www.cve.org/CVERecord?id=CVE-2020-13632" }, { "name": "CVE-2022-24281", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24281" }, { "name": "CVE-2021-32936", "url": "https://www.cve.org/CVERecord?id=CVE-2021-32936" }, { "name": "CVE-2021-22930", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22930" }, { "name": "CVE-2019-19926", "url": "https://www.cve.org/CVERecord?id=CVE-2019-19926" }, { "name": "CVE-2020-9327", "url": "https://www.cve.org/CVERecord?id=CVE-2020-9327" }, { "name": "CVE-2020-8286", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8286" }, { "name": "CVE-2020-7774", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7774" }, { "name": "CVE-2021-22918", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22918" }, { "name": "CVE-2020-27304", "url": "https://www.cve.org/CVERecord?id=CVE-2020-27304" }, { "name": "CVE-2021-32946", "url": "https://www.cve.org/CVERecord?id=CVE-2021-32946" }, { "name": "CVE-2021-41543", "url": "https://www.cve.org/CVERecord?id=CVE-2021-41543" }, { "name": "CVE-2020-8177", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8177" }, { "name": "CVE-2020-1971", "url": "https://www.cve.org/CVERecord?id=CVE-2020-1971" }, { "name": "CVE-2020-13630", "url": "https://www.cve.org/CVERecord?id=CVE-2020-13630" }, { "name": "CVE-2021-3450", "url": "https://www.cve.org/CVERecord?id=CVE-2021-3450" }, { "name": "CVE-2021-22939", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22939" }, { "name": "CVE-2019-19646", "url": "https://www.cve.org/CVERecord?id=CVE-2019-19646" }, { "name": "CVE-2021-40366", "url": "https://www.cve.org/CVERecord?id=CVE-2021-40366" }, { "name": "CVE-2021-41542", "url": "https://www.cve.org/CVERecord?id=CVE-2021-41542" }, { "name": "CVE-2021-41541", "url": "https://www.cve.org/CVERecord?id=CVE-2021-41541" }, { "name": "CVE-2021-22924", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22924" }, { "name": "CVE-2022-24309", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24309" }, { "name": "CVE-2020-8265", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8265" }, { "name": "CVE-2021-37713", "url": "https://www.cve.org/CVERecord?id=CVE-2021-37713" }, { "name": "CVE-2021-22947", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22947" }, { "name": "CVE-2019-19925", "url": "https://www.cve.org/CVERecord?id=CVE-2019-19925" }, { "name": "CVE-2021-22922", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22922" }, { "name": "CVE-2019-19924", "url": "https://www.cve.org/CVERecord?id=CVE-2019-19924" }, { "name": "CVE-2021-32938", "url": "https://www.cve.org/CVERecord?id=CVE-2021-32938" }, { "name": "CVE-2020-11656", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11656" }, { "name": "CVE-2022-26317", "url": "https://www.cve.org/CVERecord?id=CVE-2022-26317" }, { "name": "CVE-2021-22946", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22946" }, { "name": "CVE-2021-37712", "url": "https://www.cve.org/CVERecord?id=CVE-2021-37712" }, { "name": "CVE-2020-8284", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8284" }, { "name": "CVE-2021-32940", "url": "https://www.cve.org/CVERecord?id=CVE-2021-32940" }, { "name": "CVE-2021-3711", "url": "https://www.cve.org/CVERecord?id=CVE-2021-3711" }, { "name": "CVE-2021-37208", "url": "https://www.cve.org/CVERecord?id=CVE-2021-37208" }, { "name": "CVE-2021-32948", "url": "https://www.cve.org/CVERecord?id=CVE-2021-32948" }, { "name": "CVE-2021-3449", "url": "https://www.cve.org/CVERecord?id=CVE-2021-3449" }, { "name": "CVE-2022-26313", "url": "https://www.cve.org/CVERecord?id=CVE-2022-26313" }, { "name": "CVE-2021-22921", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22921" }, { "name": "CVE-2021-25216", "url": "https://www.cve.org/CVERecord?id=CVE-2021-25216" }, { "name": "CVE-2020-15358", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15358" }, { "name": "CVE-2021-43527", "url": "https://www.cve.org/CVERecord?id=CVE-2021-43527" }, { "name": "CVE-2019-19242", "url": "https://www.cve.org/CVERecord?id=CVE-2019-19242" }, { "name": "CVE-2021-22897", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22897" }, { "name": "CVE-2021-32803", "url": "https://www.cve.org/CVERecord?id=CVE-2021-32803" }, { "name": "CVE-2021-25177", "url": "https://www.cve.org/CVERecord?id=CVE-2021-25177" }, { "name": "CVE-2021-25175", "url": "https://www.cve.org/CVERecord?id=CVE-2021-25175" }, { "name": "CVE-2021-22884", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22884" }, { "name": "CVE-2021-32952", "url": "https://www.cve.org/CVERecord?id=CVE-2021-32952" }, { "name": "CVE-2019-19880", "url": "https://www.cve.org/CVERecord?id=CVE-2019-19880" }, { "name": "CVE-2018-7160", "url": "https://www.cve.org/CVERecord?id=CVE-2018-7160" }, { "name": "CVE-2021-32950", "url": "https://www.cve.org/CVERecord?id=CVE-2021-32950" }, { "name": "CVE-2021-3672", "url": "https://www.cve.org/CVERecord?id=CVE-2021-3672" }, { "name": "CVE-2021-31346", "url": "https://www.cve.org/CVERecord?id=CVE-2021-31346" }, { "name": "CVE-2022-26314", "url": "https://www.cve.org/CVERecord?id=CVE-2022-26314" }, { "name": "CVE-2021-31784", "url": "https://www.cve.org/CVERecord?id=CVE-2021-31784" }, { "name": "CVE-2021-22883", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22883" }, { "name": "CVE-2020-8231", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8231" }, { "name": "CVE-2020-13631", "url": "https://www.cve.org/CVERecord?id=CVE-2020-13631" }, { "name": "CVE-2021-25214", "url": "https://www.cve.org/CVERecord?id=CVE-2021-25214" }, { "name": "CVE-2021-22931", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22931" }, { "name": "CVE-2021-31889", "url": "https://www.cve.org/CVERecord?id=CVE-2021-31889" }, { "name": "CVE-2022-24408", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24408" }, { "name": "CVE-2021-42016", "url": "https://www.cve.org/CVERecord?id=CVE-2021-42016" }, { "name": "CVE-2021-3712", "url": "https://www.cve.org/CVERecord?id=CVE-2021-3712" }, { "name": "CVE-2021-39134", "url": "https://www.cve.org/CVERecord?id=CVE-2021-39134" }, { "name": "CVE-2019-19645", "url": "https://www.cve.org/CVERecord?id=CVE-2019-19645" }, { "name": "CVE-2020-11655", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11655" }, { "name": "CVE-2020-8287", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8287" }, { "name": "CVE-2021-22926", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22926" }, { "name": "CVE-2022-24661", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24661" }, { "name": "CVE-2021-22890", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22890" }, { "name": "CVE-2021-25219", "url": "https://www.cve.org/CVERecord?id=CVE-2021-25219" }, { "name": "CVE-2021-23840", "url": "https://www.cve.org/CVERecord?id=CVE-2021-23840" }, { "name": "CVE-2021-42018", "url": "https://www.cve.org/CVERecord?id=CVE-2021-42018" }, { "name": "CVE-2021-22923", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22923" }, { "name": "CVE-2019-19923", "url": "https://www.cve.org/CVERecord?id=CVE-2019-19923" }, { "name": "CVE-2021-39135", "url": "https://www.cve.org/CVERecord?id=CVE-2021-39135" }, { "name": "CVE-2021-25176", "url": "https://www.cve.org/CVERecord?id=CVE-2021-25176" }, { "name": "CVE-2021-31890", "url": "https://www.cve.org/CVERecord?id=CVE-2021-31890" }, { "name": "CVE-2021-25178", "url": "https://www.cve.org/CVERecord?id=CVE-2021-25178" }, { "name": "CVE-2021-22876", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22876" }, { "name": "CVE-2021-23362", "url": "https://www.cve.org/CVERecord?id=CVE-2021-23362" }, { "name": "CVE-2019-19603", "url": "https://www.cve.org/CVERecord?id=CVE-2019-19603" }, { "name": "CVE-2021-25217", "url": "https://www.cve.org/CVERecord?id=CVE-2021-25217" }, { "name": "CVE-2021-25173", "url": "https://www.cve.org/CVERecord?id=CVE-2021-25173" }, { "name": "CVE-2021-22945", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22945" }, { "name": "CVE-2022-25311", "url": "https://www.cve.org/CVERecord?id=CVE-2022-25311" }, { "name": "CVE-2021-31344", "url": "https://www.cve.org/CVERecord?id=CVE-2021-31344" }, { "name": "CVE-2021-37209", "url": "https://www.cve.org/CVERecord?id=CVE-2021-37209" }, { "name": "CVE-2021-42019", "url": "https://www.cve.org/CVERecord?id=CVE-2021-42019" }, { "name": "CVE-2020-8625", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8625" } ], "initial_release_date": "2022-03-08T00:00:00", "last_revision_date": "2022-03-08T00:00:00", "links": [], "reference": "CERTFR-2022-AVI-216", "revisions": [ { "description": "Version initiale", "revision_date": "2022-03-08T00:00:00.000000" } ], "risks": [ { "description": "Ex\u00e9cution de code arbitraire \u00e0 distance" }, { "description": "\u00c9l\u00e9vation de privil\u00e8ges" }, { "description": "D\u00e9ni de service \u00e0 distance" }, { "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es" }, { "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es" }, { "description": "Contournement de la politique de s\u00e9curit\u00e9" }, { "description": "Injection de code indirecte \u00e0 distance (XSS)" } ], "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSiemens. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0\ndistance et un contournement de la politique de s\u00e9curit\u00e9.\n", "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Siemens", "vendor_advisories": [ { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-166747 du 8 mars 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-166747.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-252466 du 8 mars 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-252466.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-562051 du 8 mars 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-562051.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-223353 du 8 mars 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-223353.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-337210 du 8 mars 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-337210.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-148641 du 8 mars 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-148641.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-389290 du 8 mars 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-389290.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-764417 du 8 mars 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-764417.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-256353 du 8 mars 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-256353.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-703715 du 8 mars 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-703715.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-594438 du 8 mars 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-594438.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-415938 du 8 mars 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-415938.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-134279 du 8 mars 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-134279.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-155599 du 8 mars 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-155599.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-406691 du 8 mars 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-406691.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-250085 du 8 mars 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-250085.html" } ] }
cnvd-2022-17796
Vulnerability from cnvd
用户可参考如下供应商提供的安全公告获得补丁信息: https://cert-portal.siemens.com/productcert/pdf/ssa-134279.pdf
Name | Siemens Mendix Forgot Password Appstore module >= V3.3.0,< V3.5.1 |
---|
{ "cves": { "cve": { "cveNumber": "CVE-2022-26313" } }, "description": "Forgot Password module\u5141\u8bb8\u7528\u6237\u6ce8\u518c\u5e94\u7528\u7a0b\u5e8f\u6216\u91cd\u7f6e\u81ea\u5df1\u7684\u5bc6\u7801\uff0c\u800c\u65e0\u9700\u7ba1\u7406\u5458\u53c2\u4e0e\u3002\n\nsiemens Mendix Forgot Password Appstore module\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u5728\u53d7\u5f71\u54cd\u4ea7\u54c1\u7684\u67d0\u4e9b\u914d\u7f6e\u4e2d\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u4f7f\u7528\u6ce8\u518c\u6d41\u52ab\u6301\u4efb\u610f\u7528\u6237\u5e10\u6237\u3002", "formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u4f9b\u5e94\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u516c\u544a\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttps://cert-portal.siemens.com/productcert/pdf/ssa-134279.pdf", "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e", "number": "CNVD-2022-17796", "openTime": "2022-03-09", "patchDescription": "Forgot Password module\u5141\u8bb8\u7528\u6237\u6ce8\u518c\u5e94\u7528\u7a0b\u5e8f\u6216\u91cd\u7f6e\u81ea\u5df1\u7684\u5bc6\u7801\uff0c\u800c\u65e0\u9700\u7ba1\u7406\u5458\u53c2\u4e0e\u3002\r\n\r\nsiemens Mendix Forgot Password Appstore module\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u5728\u53d7\u5f71\u54cd\u4ea7\u54c1\u7684\u67d0\u4e9b\u914d\u7f6e\u4e2d\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u4f7f\u7528\u6ce8\u518c\u6d41\u52ab\u6301\u4efb\u610f\u7528\u6237\u5e10\u6237\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002", "patchName": "siemens Mendix Forgot Password Appstore module\u8bbf\u95ee\u63a7\u5236\u4e0d\u5f53\u6f0f\u6d1e\uff08CNVD-2022-17796\uff09\u7684\u8865\u4e01", "products": { "product": "Siemens Mendix Forgot Password Appstore module \u003e= V3.3.0\uff0c\u003c V3.5.1" }, "referenceLink": "https://cert-portal.siemens.com/productcert/pdf/ssa-134279.pdf", "serverity": "\u9ad8", "submitTime": "2022-03-09", "title": "siemens Mendix Forgot Password Appstore module\u8bbf\u95ee\u63a7\u5236\u4e0d\u5f53\u6f0f\u6d1e\uff08CNVD-2022-17796\uff09" }
ICSA-22-069-04
Vulnerability from csaf_cisa
Notes
{ "document": { "acknowledgments": [ { "organization": "Siemens ProductCERT", "summary": "reporting these vulnerabilities to CISA." } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Disclosure is not limited", "tlp": { "label": "WHITE", "url": "https://us-cert.cisa.gov/tlp/" } }, "notes": [ { "category": "summary", "text": "Mendix Forgot Password Appstore module contains two vulnerabilities that could allow unauthorized users to take over accounts.\n\nMendix has released an update for the Mendix Forgot Password Appstore module and recommends to update to the latest version.", "title": "Summary" }, { "category": "general", "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "title": "General Recommendations" }, { "category": "general", "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories", "title": "Additional Resources" }, { "category": "legal_disclaimer", "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.", "title": "Terms of Use" }, { "category": "legal_disclaimer", "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.", "title": "Legal Notice" }, { "category": "other", "text": "This CISA CSAF advisory was converted from Siemens ProductCERT\u0027s CSAF advisory.", "title": "Advisory Conversion Disclaimer" }, { "category": "other", "text": "Multiple", "title": "Critical infrastructure sectors" }, { "category": "other", "text": "Worldwide", "title": "Countries/areas deployed" }, { "category": "other", "text": "Germany", "title": "Company headquarters location" }, { "category": "general", "text": "CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.", "title": "Recommended Practices" }, { "category": "general", "text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.", "title": "Recommended Practices" }, { "category": "general", "text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.", "title": "Recommended Practices" }, { "category": "general", "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.", "title": "Recommended Practices" }, { "category": "general", "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.", "title": "Recommended Practices" } ], "publisher": { "category": "other", "contact_details": "central@cisa.dhs.gov", "name": "CISA", "namespace": "https://www.cisa.gov/" }, "references": [ { "category": "self", "summary": "SSA-134279: Vulnerability in Mendix Forgot Password Appstore module - CSAF Version", "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-134279.json" }, { "category": "self", "summary": "SSA-134279: Vulnerability in Mendix Forgot Password Appstore module - TXT Version", "url": "https://cert-portal.siemens.com/productcert/txt/ssa-134279.txt" }, { "category": "self", "summary": "SSA-134279: Vulnerability in Mendix Forgot Password Appstore module - PDF Version", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-134279.pdf" }, { "category": "self", "summary": "ICS Advisory ICSA-22-069-04 JSON", "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2022/icsa-22-069-04.json" }, { "category": "self", "summary": "ICS Advisory ICSA-22-069-04 - Web Version", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-069-04" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/topics/industrial-control-systems" }, { "category": "external", "summary": "Recommended Practices", "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B" } ], "title": "Siemens SINEMA Mendix Forgot Password Appstore", "tracking": { "current_release_date": "2025-05-06T06:00:00.000000Z", "generator": { "engine": { "name": "CISA CSAF Generator", "version": "1.0.0" } }, "id": "ICSA-22-069-04", "initial_release_date": "2022-03-08T00:00:00.000000Z", "revision_history": [ { "date": "2022-03-08T00:00:00.000000Z", "legacy_version": "1.0", "number": "1", "summary": "Publication Date" }, { "date": "2025-05-06T06:00:00.000000Z", "legacy_version": "Revision", "number": "2", "summary": "Revision - Fixing typos" } ], "status": "final", "version": "2" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003e=V3.3.0_\u003cV3.5.1", "product": { "name": "Mendix Forgot Password Appstore module", "product_id": "CSAFPID-0001" } } ], "category": "product_name", "name": "Mendix Forgot Password Appstore module" }, { "branches": [ { "category": "product_version_range", "name": "\u003cV3.2.2", "product": { "name": "Mendix Forgot Password Appstore module (Mendix 7 compatible)", "product_id": "CSAFPID-0002" } } ], "category": "product_name", "name": "Mendix Forgot Password Appstore module (Mendix 7 compatible)" } ], "category": "vendor", "name": "Siemens" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-26313", "cwe": { "id": "CWE-284", "name": "Improper Access Control" }, "notes": [ { "category": "summary", "text": "In certain configurations of the affected product, a threat actor could use the sign up flow to hijack arbitrary user accounts.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "references": [ { "summary": "CVE-2022-26313 - Mendix Forgot Password Appstore module", "url": "https://marketplace.mendix.com/link/component/1296" }, { "summary": "CVE-2022-26313 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2022-26313.json" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V3.5.1 or later", "product_ids": [ "CSAFPID-0001" ], "url": "https://marketplace.mendix.com/link/component/1296" }, { "category": "mitigation", "details": "CVE-2022-26313: Disable sign up as described in the documentation", "product_ids": [ "CSAFPID-0001" ] }, { "category": "workaround", "details": "Restrict access to application webserver for trusted users only", "product_ids": [ "CSAFPID-0001" ] } ], "scores": [ { "cvss_v3": { "baseScore": 9.1, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2022-26313" }, { "cve": "CVE-2022-26314", "cwe": { "id": "CWE-307", "name": "Improper Restriction of Excessive Authentication Attempts" }, "notes": [ { "category": "summary", "text": "Initial passwords are generated in an insecure manner. This could allow an unauthenticated remote attacker to efficiently brute force passwords in specific situations.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "CVE-2022-26314 - Mendix Forgot Password Appstore module", "url": "https://marketplace.mendix.com/link/component/1296" }, { "summary": "CVE-2022-26314 - Mendix Forgot Password Appstore module (Mendix 7 compatible)", "url": "https://marketplace.mendix.com/link/component/1296" }, { "summary": "CVE-2022-26314 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2022-26314.json" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V3.5.1 or later", "product_ids": [ "CSAFPID-0001" ], "url": "https://marketplace.mendix.com/link/component/1296" }, { "category": "vendor_fix", "details": "Update to V3.2.2 or later version", "product_ids": [ "CSAFPID-0002" ], "url": "https://marketplace.mendix.com/link/component/1296" }, { "category": "mitigation", "details": "CVE-2022-26313: Disable sign up as described in the documentation", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "workaround", "details": "Restrict access to application webserver for trusted users only", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.4, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2022-26314" } ] }
icsa-22-069-04
Vulnerability from csaf_cisa
Notes
{ "document": { "acknowledgments": [ { "organization": "Siemens ProductCERT", "summary": "reporting these vulnerabilities to CISA." } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Disclosure is not limited", "tlp": { "label": "WHITE", "url": "https://us-cert.cisa.gov/tlp/" } }, "notes": [ { "category": "summary", "text": "Mendix Forgot Password Appstore module contains two vulnerabilities that could allow unauthorized users to take over accounts.\n\nMendix has released an update for the Mendix Forgot Password Appstore module and recommends to update to the latest version.", "title": "Summary" }, { "category": "general", "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "title": "General Recommendations" }, { "category": "general", "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories", "title": "Additional Resources" }, { "category": "legal_disclaimer", "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.", "title": "Terms of Use" }, { "category": "legal_disclaimer", "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.", "title": "Legal Notice" }, { "category": "other", "text": "This CISA CSAF advisory was converted from Siemens ProductCERT\u0027s CSAF advisory.", "title": "Advisory Conversion Disclaimer" }, { "category": "other", "text": "Multiple", "title": "Critical infrastructure sectors" }, { "category": "other", "text": "Worldwide", "title": "Countries/areas deployed" }, { "category": "other", "text": "Germany", "title": "Company headquarters location" }, { "category": "general", "text": "CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.", "title": "Recommended Practices" }, { "category": "general", "text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.", "title": "Recommended Practices" }, { "category": "general", "text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.", "title": "Recommended Practices" }, { "category": "general", "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.", "title": "Recommended Practices" }, { "category": "general", "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.", "title": "Recommended Practices" } ], "publisher": { "category": "other", "contact_details": "central@cisa.dhs.gov", "name": "CISA", "namespace": "https://www.cisa.gov/" }, "references": [ { "category": "self", "summary": "SSA-134279: Vulnerability in Mendix Forgot Password Appstore module - CSAF Version", "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-134279.json" }, { "category": "self", "summary": "SSA-134279: Vulnerability in Mendix Forgot Password Appstore module - TXT Version", "url": "https://cert-portal.siemens.com/productcert/txt/ssa-134279.txt" }, { "category": "self", "summary": "SSA-134279: Vulnerability in Mendix Forgot Password Appstore module - PDF Version", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-134279.pdf" }, { "category": "self", "summary": "ICS Advisory ICSA-22-069-04 JSON", "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2022/icsa-22-069-04.json" }, { "category": "self", "summary": "ICS Advisory ICSA-22-069-04 - Web Version", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-069-04" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/topics/industrial-control-systems" }, { "category": "external", "summary": "Recommended Practices", "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B" } ], "title": "Siemens SINEMA Mendix Forgot Password Appstore", "tracking": { "current_release_date": "2025-05-06T06:00:00.000000Z", "generator": { "engine": { "name": "CISA CSAF Generator", "version": "1.0.0" } }, "id": "ICSA-22-069-04", "initial_release_date": "2022-03-08T00:00:00.000000Z", "revision_history": [ { "date": "2022-03-08T00:00:00.000000Z", "legacy_version": "1.0", "number": "1", "summary": "Publication Date" }, { "date": "2025-05-06T06:00:00.000000Z", "legacy_version": "Revision", "number": "2", "summary": "Revision - Fixing typos" } ], "status": "final", "version": "2" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003e=V3.3.0_\u003cV3.5.1", "product": { "name": "Mendix Forgot Password Appstore module", "product_id": "CSAFPID-0001" } } ], "category": "product_name", "name": "Mendix Forgot Password Appstore module" }, { "branches": [ { "category": "product_version_range", "name": "\u003cV3.2.2", "product": { "name": "Mendix Forgot Password Appstore module (Mendix 7 compatible)", "product_id": "CSAFPID-0002" } } ], "category": "product_name", "name": "Mendix Forgot Password Appstore module (Mendix 7 compatible)" } ], "category": "vendor", "name": "Siemens" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-26313", "cwe": { "id": "CWE-284", "name": "Improper Access Control" }, "notes": [ { "category": "summary", "text": "In certain configurations of the affected product, a threat actor could use the sign up flow to hijack arbitrary user accounts.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "references": [ { "summary": "CVE-2022-26313 - Mendix Forgot Password Appstore module", "url": "https://marketplace.mendix.com/link/component/1296" }, { "summary": "CVE-2022-26313 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2022-26313.json" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V3.5.1 or later", "product_ids": [ "CSAFPID-0001" ], "url": "https://marketplace.mendix.com/link/component/1296" }, { "category": "mitigation", "details": "CVE-2022-26313: Disable sign up as described in the documentation", "product_ids": [ "CSAFPID-0001" ] }, { "category": "workaround", "details": "Restrict access to application webserver for trusted users only", "product_ids": [ "CSAFPID-0001" ] } ], "scores": [ { "cvss_v3": { "baseScore": 9.1, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2022-26313" }, { "cve": "CVE-2022-26314", "cwe": { "id": "CWE-307", "name": "Improper Restriction of Excessive Authentication Attempts" }, "notes": [ { "category": "summary", "text": "Initial passwords are generated in an insecure manner. This could allow an unauthenticated remote attacker to efficiently brute force passwords in specific situations.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "CVE-2022-26314 - Mendix Forgot Password Appstore module", "url": "https://marketplace.mendix.com/link/component/1296" }, { "summary": "CVE-2022-26314 - Mendix Forgot Password Appstore module (Mendix 7 compatible)", "url": "https://marketplace.mendix.com/link/component/1296" }, { "summary": "CVE-2022-26314 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2022-26314.json" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to V3.5.1 or later", "product_ids": [ "CSAFPID-0001" ], "url": "https://marketplace.mendix.com/link/component/1296" }, { "category": "vendor_fix", "details": "Update to V3.2.2 or later version", "product_ids": [ "CSAFPID-0002" ], "url": "https://marketplace.mendix.com/link/component/1296" }, { "category": "mitigation", "details": "CVE-2022-26313: Disable sign up as described in the documentation", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] }, { "category": "workaround", "details": "Restrict access to application webserver for trusted users only", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.4, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2022-26314" } ] }
gsd-2022-26313
Vulnerability from gsd
{ "GSD": { "alias": "CVE-2022-26313", "description": "A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions \u003e= V3.3.0 \u003c V3.5.1). In certain configurations of the affected product, a threat actor could use the sign up flow to hijack arbitrary user accounts.", "id": "GSD-2022-26313" }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2022-26313" ], "details": "A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions \u003e= V3.3.0 \u003c V3.5.1). In certain configurations of the affected product, a threat actor could use the sign up flow to hijack arbitrary user accounts.", "id": "GSD-2022-26313", "modified": "2023-12-13T01:19:39.316983Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "productcert@siemens.com", "ID": "CVE-2022-26313", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "Mendix Forgot Password Appstore module", "version": { "version_data": [ { "version_value": "All versions \u003e= V3.3.0 \u003c V3.5.1" } ] } } ] }, "vendor_name": "Siemens" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions \u003e= V3.3.0 \u003c V3.5.1). In certain configurations of the affected product, a threat actor could use the sign up flow to hijack arbitrary user accounts." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-284: Improper Access Control" } ] } ] }, "references": { "reference_data": [ { "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-134279.pdf", "refsource": "MISC", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-134279.pdf" } ] } }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:mendix:forgot_password:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "3.5.1", "versionStartIncluding": "3.3.0", "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "productcert@siemens.com", "ID": "CVE-2022-26313" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions \u003e= V3.3.0 \u003c V3.5.1). In certain configurations of the affected product, a threat actor could use the sign up flow to hijack arbitrary user accounts." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "NVD-CWE-noinfo" } ] } ] }, "references": { "reference_data": [ { "name": "N/A", "refsource": "CONFIRM", "tags": [ "Mitigation", "Patch", "Vendor Advisory" ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-134279.pdf" } ] } }, "impact": { "baseMetricV2": { "acInsufInfo": false, "cvssV2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false }, "baseMetricV3": { "cvssV3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 5.9 } }, "lastModifiedDate": "2022-03-11T19:01Z", "publishedDate": "2022-03-08T12:15Z" } } }
fkie_cve-2022-26313
Vulnerability from fkie_nvd
URL | Tags | ||
---|---|---|---|
productcert@siemens.com | https://cert-portal.siemens.com/productcert/pdf/ssa-134279.pdf | Mitigation, Patch, Vendor Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | https://cert-portal.siemens.com/productcert/pdf/ssa-134279.pdf | Mitigation, Patch, Vendor Advisory |
Vendor | Product | Version | |
---|---|---|---|
mendix | forgot_password | * |
{ "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:mendix:forgot_password:*:*:*:*:*:*:*:*", "matchCriteriaId": "394B806B-A2A7-4BA4-B7DC-08756FA27908", "versionEndExcluding": "3.5.1", "versionStartIncluding": "3.3.0", "vulnerable": true } ], "negate": false, "operator": "OR" } ] } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions \u003e= V3.3.0 \u003c V3.5.1). In certain configurations of the affected product, a threat actor could use the sign up flow to hijack arbitrary user accounts." }, { "lang": "es", "value": "Se ha identificado una vulnerabilidad en el m\u00f3dulo Mendix Forgot Password Appstore (Todas las versiones posteriores a V3.3.0 incluy\u00e9ndola, anteriores a V3.5.1). En determinadas configuraciones del producto afectado, un actor de amenaza podr\u00eda usar el flujo de registro para secuestrar cuentas de usuario arbitrarias" } ], "id": "CVE-2022-26313", "lastModified": "2024-11-21T06:53:44.287", "metrics": { "cvssMetricV2": [ { "acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false } ], "cvssMetricV31": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary" } ] }, "published": "2022-03-08T12:15:11.777", "references": [ { "source": "productcert@siemens.com", "tags": [ "Mitigation", "Patch", "Vendor Advisory" ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-134279.pdf" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Mitigation", "Patch", "Vendor Advisory" ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-134279.pdf" } ], "sourceIdentifier": "productcert@siemens.com", "vulnStatus": "Modified", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-284" } ], "source": "productcert@siemens.com", "type": "Secondary" }, { "description": [ { "lang": "en", "value": "NVD-CWE-noinfo" } ], "source": "nvd@nist.gov", "type": "Primary" } ] }
ghsa-773v-62jq-mhc6
Vulnerability from github
A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions >= V3.3.0 < V3.5.1). In certain configurations of the affected product, a threat actor could use the sign up flow to hijack arbitrary user accounts.
{ "affected": [], "aliases": [ "CVE-2022-26313" ], "database_specific": { "cwe_ids": [], "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2022-03-08T12:15:00Z", "severity": "CRITICAL" }, "details": "A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions \u003e= V3.3.0 \u003c V3.5.1). In certain configurations of the affected product, a threat actor could use the sign up flow to hijack arbitrary user accounts.", "id": "GHSA-773v-62jq-mhc6", "modified": "2022-03-17T00:02:44Z", "published": "2022-03-09T00:00:46Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-26313" }, { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-134279.pdf" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "type": "CVSS_V3" } ] }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.