{
  "document": {
    "category": "Siemens Security Advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited.",
      "tlp": {
        "label": "WHITE"
      }
    },
    "notes": [
      {
        "category": "summary",
        "text": "A vulnerability in Mendix Studio Pro was discovered, that, if acted upon by a malicious user, could allow to retrieve the status of a job run by another user in certain cases.\n\nMendix has released updates for the affected product lines, recommends to update to the latest versions and to redeploy the applications.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "productcert@siemens.com",
      "name": "Siemens ProductCERT",
      "namespace": "https://www.siemens.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-415938: Improper Access Control Vulnerability in Mendix - PDF Version",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-415938.pdf"
      },
      {
        "category": "self",
        "summary": "SSA-415938: Improper Access Control Vulnerability in Mendix - TXT Version",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-415938.txt"
      },
      {
        "category": "self",
        "summary": "SSA-415938: Improper Access Control Vulnerability in Mendix - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-415938.json"
      }
    ],
    "title": "SSA-415938: Improper Access Control Vulnerability in Mendix",
    "tracking": {
      "current_release_date": "2022-03-08T00:00:00Z",
      "generator": {
        "engine": {
          "name": "Siemens ProductCERT CSAF Generator",
          "version": "1"
        }
      },
      "id": "SSA-415938",
      "initial_release_date": "2022-03-08T00:00:00Z",
      "revision_history": [
        {
          "date": "2022-03-08T00:00:00Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c V7.23.29",
                "product": {
                  "name": "Mendix Applications using Mendix 7",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "Mendix Applications using Mendix 7"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-26317",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "notes": [
        {
          "category": "summary",
          "text": "When returning the result of a completed Microflow execution call the affected framework does not correctly verify, if the request was initially made by the user requesting the result. Together with predictable identifiers for Microflow execution calls, this could allow a malicious attacker to retrieve information about arbitrary Microflow execution calls made by users within the affected system.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "references": [
        {
          "summary": "CVE-2022-26317 - Mendix Applications using Mendix 7",
          "url": "https://docs.mendix.com/releasenotes/studio-pro/7.23"
        },
        {
          "summary": "CVE-2022-26317 Mitre 5.0 json",
          "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2022-26317.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update your Mendix Project to V7.23.29 or later version and redeploy your application",
          "product_ids": [
            "1"
          ],
          "url": "https://docs.mendix.com/releasenotes/studio-pro/7.23"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2022-26317"
    }
  ]
}