CVE-2022-25650

{"containers": {"cna": {"affected": [{"product": "Mendix Applications using Mendix 7", "vendor": "Siemens", "versions": [{"status": "affected", "version": "All versions < V7.23.27"}]}, {"product": "Mendix Applications using Mendix 8", "vendor": "Siemens", "versions": [{"status": "affected", "version": "All versions < V8.18.14"}]}, {"product": "Mendix Applications using Mendix 9", "vendor": "Siemens", "versions": [{"status": "affected", "version": "All versions < V9.12.0"}]}, {"product": "Mendix Applications using Mendix 9 (V9.6)", "vendor": "Siemens", "versions": [{"status": "affected", "version": "All versions < V9.6.3"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.27), Mendix Applications using Mendix 8 (All versions < V8.18.14), Mendix Applications using Mendix 9 (All versions < V9.12.0), Mendix Applications using Mendix 9 (V9.6) (All versions < V9.6.3). When querying the database, it is possible to sort the results using a protected field. With this an authenticated attacker could extract information about the contents of a protected field."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "description": "CWE-284: Improper Access Control", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-04-12T09:07:42.000Z", "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "shortName": "siemens"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-870917.pdf"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "productcert@siemens.com", "ID": "CVE-2022-25650", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Mendix Applications using Mendix 7", "version": {"version_data": [{"version_value": "All versions < V7.23.27"}]}}, {"product_name": "Mendix Applications using Mendix 8", "version": {"version_data": [{"version_value": "All versions < V8.18.14"}]}}, {"product_name": "Mendix Applications using Mendix 9", "version": {"version_data": [{"version_value": "All versions < V9.12.0"}]}}, {"product_name": "Mendix Applications using Mendix 9 (V9.6)", "version": {"version_data": [{"version_value": "All versions < V9.6.3"}]}}]}, "vendor_name": "Siemens"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.27), Mendix Applications using Mendix 8 (All versions < V8.18.14), Mendix Applications using Mendix 9 (All versions < V9.12.0), Mendix Applications using Mendix 9 (V9.6) (All versions < V9.6.3). When querying the database, it is possible to sort the results using a protected field. With this an authenticated attacker could extract information about the contents of a protected field."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-284: Improper Access Control"}]}]}, "references": {"reference_data": [{"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-870917.pdf", "refsource": "MISC", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-870917.pdf"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T04:42:50.611Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-870917.pdf"}]}]}, "cveMetadata": {"assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "assignerShortName": "siemens", "cveId": "CVE-2022-25650", "datePublished": "2022-04-12T09:07:42.000Z", "dateReserved": "2022-02-22T00:00:00.000Z", "dateUpdated": "2024-08-03T04:42:50.611Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "Mendix Applications using Mendix 7", "vendor": "Siemens", "versions": [{"status": "affected", "version": "All versions < V7.23.27"}]}, {"product": "Mendix Applications using Mendix 8", "vendor": "Siemens", "versions": [{"status": "affected", "version": "All versions < V8.18.14"}]}, {"product": "Mendix Applications using Mendix 9", "vendor": "Siemens", "versions": [{"status": "affected", "version": "All versions < V9.12.0"}]}, {"product": "Mendix Applications using Mendix 9 (V9.6)", "vendor": "Siemens", "versions": [{"status": "affected", "version": "All versions < V9.6.3"}]}], "source": "productcert@siemens.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mendix:mendix:*:*:*:*:*:*:*:*", "matchCriteriaId": "2547E594-D1AA-4D03-B8DE-612C0FC81C64", "versionEndExcluding": "7.23.27", "versionStartIncluding": "7.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mendix:mendix:*:*:*:*:*:*:*:*", "matchCriteriaId": "19F81FC8-0502-4A75-B3C7-E4CCE634B7B7", "versionEndExcluding": "8.18.14", "versionStartIncluding": "8.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mendix:mendix:*:*:*:*:*:*:*:*", "matchCriteriaId": "CDAACA5B-273A-4512-8646-C5B56BA3AF76", "versionEndExcluding": "9.12.0", "versionStartIncluding": "9.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.27), Mendix Applications using Mendix 8 (All versions < V8.18.14), Mendix Applications using Mendix 9 (All versions < V9.12.0), Mendix Applications using Mendix 9 (V9.6) (All versions < V9.6.3). When querying the database, it is possible to sort the results using a protected field. With this an authenticated attacker could extract information about the contents of a protected field."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad en las aplicaciones de Mendix usando Mendix 7 (todas las versiones anteriores a V7.23.27), las aplicaciones de Mendix usando Mendix 8 (todas las versiones anteriores a V8.18.14), las aplicaciones de Mendix usando Mendix 9 (todas las versiones anteriores a V9.12.0), las aplicaciones de Mendix usando Mendix 9 (V9.6) (todas las versiones anteriores a V9.6.3). Cuando es consultada la base de datos, es posible ordenar los resultados usando un campo protegido. Con esto un atacante autenticado podr\u00eda extraer informaci\u00f3n sobre el contenido de un campo protegido"}], "id": "CVE-2022-25650", "lastModified": "2026-06-17T04:33:50.293", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-04-12T09:15:14.543", "references": [{"source": "productcert@siemens.com", "tags": ["Mitigation", "Patch", "Vendor Advisory"], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-870917.pdf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mitigation", "Patch", "Vendor Advisory"], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-870917.pdf"}], "sourceIdentifier": "productcert@siemens.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "productcert@siemens.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}