Skip to content
Fencer Vulns
critical 9.8

CVE-2022-44457 json

A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions < V1.17.0), Mendix SAML (Mendix 7 compatible) (All v…

published 2022-11-08 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-47400

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.8%
EPSS 0.8% chance of exploitation in 30 days, percentile 58%
public exploits
0
none known

Summary

A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions < V1.17.0), Mendix SAML (Mendix 7 compatible) (All versions >= V1.17.0 < V1.17.2), Mendix SAML (Mendix 8 compatible) (All versions < V2.3.0), Mendix SAML (Mendix 8 compatible) (All versions >= V2.3.0 < V2.3.2), Mendix SAML (Mendix 9 compatible, New Track) (All versions < V3.3.1), Mendix SAML (Mendix 9 compatible, New Track) (All versions >= V3.3.1 < V3.3.5), Mendix SAML (Mendix 9 compatible, Upgrade Track) (All versions < V3.3.0), Mendix SAML (Mendix 9 compatible, Upgrade Track) (All versions >= V3.3.0 < V3.3.4). Affected versions of the module insufficiently protect from packet capture replay, only when the not recommended, non default configuration option `'Allow Idp Initiated Authentication'` is enabled. This CVE entry describes the incomplete fix for CVE-2022-37011 in a specific non default configuration.

Patch / fix

  • mendix saml 1.17.0, 2.3.2, 3.3.4

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-22-258-04 updated cvss 7.4

Siemens Mendix SAML Module

  • Siemens Mendix SAML (Mendix 7 compatible) <V1.17.0, >=V1.17.0_<V1.17.2
    affected: fixed in V1.17.0 marketplace.mendix.com
  • Siemens Mendix SAML (Mendix 8 compatible) <V2.3.0, >=V2.3.0_<V2.3.2
    affected: fixed in V2.3.0 marketplace.mendix.com
  • Siemens Mendix SAML (Mendix 9 compatible, New Track) <V3.3.1, >=V3.3.1_<V3.3.5
    affected: fixed in V3.3.5 marketplace.mendix.com
  • Siemens Mendix SAML (Mendix 9 compatible, Upgrade Track) <V3.3.0, >=V3.3.0_<V3.3.4
    affected: fixed in V3.3.4 marketplace.mendix.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
18 mo ago

Exploit prediction

0.84% chance of exploitation in the next 30 days, higher than 58% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Siemens Mendix SAML (Mendix 7 compatible)
  • Siemens Mendix SAML (Mendix 8 compatible)
  • Siemens Mendix SAML (Mendix 9 compatible, New Track)
  • Siemens Mendix SAML (Mendix 9 compatible, Upgrade Track)

Classification

Weakness
  • CWE-294 Authentication Bypass by Capture-replay

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.