Skip to content
Fencer Vulns
medium 6.5

CVE-2022-34466 json

A vulnerability has been identified in Mendix Applications using Mendix 9 (All versions >= V9.11 < V9.15), Mendix Applications using Mendix…

published 2022-07-12 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-37421

cvss
6.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 54%
public exploits
0
none known

Summary

A vulnerability has been identified in Mendix Applications using Mendix 9 (All versions >= V9.11 < V9.15), Mendix Applications using Mendix 9 (V9.12) (All versions < V9.12.3). An expression injection vulnerability was discovered in the Workflow subsystem of Mendix Runtime, that can affect the running applications. The vulnerability could allow a malicious user to leak sensitive information in a certain configuration.

Patch / fix

  • mendix mendix 9.15.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-22-195-10 updated cvss 6.5

Siemens Mendix Applications

  • Siemens Mendix Applications using Mendix 9 >=V9.11_<V9.15
    affected: fixed in V9.15 docs.mendix.com
  • Siemens Mendix Applications using Mendix 9 (V9.12) <V9.12.3
    affected: fixed in V9.12.3 docs.mendix.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

0.72% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 3.5 AV:N/AC:M/Au:S/C:P/I:N/A:N

Affected products

  • Siemens Mendix Applications using Mendix 9
  • Siemens Mendix Applications using Mendix 9 (V9.12)

Classification

Weakness
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component
  • CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.