CVE-2022-44457
A vulnerability has been identified in Mendix SAML Module (Mendix 7 compatible) (All versions < V1.17.0), Mendix SAML Module (Mendix 7 compatible) (All versions >= V1.17.0), Mendix SAML Module (Mendix 8 compatible) (All versions < V2.3.0), Mendix SAML Module (Mendix 8 compatible) (All versions >= V2.3.0 < V2.3.2), Mendix SAML Module (Mendix 9 compatible, New Track) (All versions < V3.3.1), Mendix SAML Module (Mendix 9 compatible, New Track) (All versions >= V3.3.1 < V3.3.5), Mendix SAML Module (Mendix 9 compatible, Upgrade Track) (All versions < V3.3.0), Mendix SAML Module (Mendix 9 compatible, Upgrade Track) (All versions >= V3.3.0 < V3.3.4). Affected versions of the module insufficiently protect from packet capture replay, only when the not recommended, non default configuration option `'Allow Idp Initiated Authentication'` is enabled. This CVE entry describes the incomplete fix for CVE-2022-37011 in a specific non default configuration.
EPSS 0.76% · 55.2th percentile
Risk Scores
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Siemens | Mendix SAML (Mendix 8 compatible) | All versions < V2.3.0, * |
| Siemens | Mendix SAML (Mendix 9 compatible, Upgrade Track) | All versions >= V3.3.0 < V3.3.4, All versions < V3.3.0 |
| Siemens | Mendix SAML (Mendix 7 compatible) | * |
| Siemens | Mendix SAML (Mendix 9 compatible, New Track) | All versions >= V3.3.1 < V3.3.5, * |
| mendix | saml | 3.3.0, 2.3.0, 0 |
Timeline
- Nov 8, 2022 CVE Published
- Nov 9, 2022 EPSS Score
- Dec 23, 2022 EPSS Score
- Feb 5, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Mar 21, 2023 EPSS Score
- May 4, 2023 EPSS Score
- Jun 17, 2023 EPSS Score
- Jul 31, 2023 EPSS Score
- Sep 13, 2023 EPSS Score
- Oct 28, 2023 EPSS Score
- Dec 11, 2023 EPSS Score