{"id":"CVE-2022-32285","aliases":["EUVD-2022-53480","GHSA-v9xm-x7mc-f74g"],"status":"published","title":"A vulnerability has been identified in Mendix SAML Module (Mendix 7 compatible) (All versions \u003c...","description":"A vulnerability has been identified in Mendix SAML Module (Mendix 7 compatible) (All versions \u003c V1.16.6), Mendix SAML Module (Mendix 8 compatible) (All versions \u003c V2.2.2), Mendix SAML Module (Mendix 9 compatible) (All versions \u003c V3.2.3). The affected module is vulnerable to XML External Entity (XXE) attacks due to insufficient input sanitation. This may allow an attacker to disclose confidential data under certain circumstances.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01043,"percentile":0.64326,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-611"],"published":"2022-06-14T09:22:19Z","modified":"2026-06-17T04:47:03Z","products":[{"vendor":"mendix","product":"saml"},{"vendor":"siemens","product":"mendix saml module (mendix 7 compatible)"},{"vendor":"siemens","product":"mendix saml module (mendix 8 compatible)"},{"vendor":"siemens","product":"mendix saml module (mendix 9 compatible)"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-740594.pdf","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-32285"},{"url":"https://github.com/advisories/GHSA-v9xm-x7mc-f74g"}],"sources":{"cve":[{"id":"CVE-2022-32285","description":"A vulnerability has been identified in Mendix SAML Module (Mendix 7 compatible) (All versions \u003c V1.16.6), Mendix SAML Module (Mendix 8 compatible) (All versions \u003c V2.2.2), Mendix SAML Module (Mendix 9 compatible) (All versions \u003c V3.2.3). The affected module is vulnerable to XML External Entity (XXE) attacks due to insufficient input sanitation. This may allow an attacker to disclose confidential data under certain circumstances.","status":"published","published":"2022-06-14T09:22:19Z","modified":"2024-08-03T07:39:51.062Z","cwes":["CWE-611"],"updated_at":"2026-11-02T14:34:36.917505Z"}],"euvd":[{"id":"EUVD-2022-53480","description":"A vulnerability has been identified in Mendix SAML Module (Mendix 7 compatible) (All versions \u003c V1.16.6), Mendix SAML Module (Mendix 8 compatible) (All versions \u003c V2.2.2), Mendix SAML Module (Mendix 9 compatible) (All versions \u003c V3.2.3). The affected module is vulnerable to XML External Entity (XXE) attacks due to insufficient input sanitation. This may allow an attacker to disclose confidential data under certain circumstances.","status":"published","published":"2022-06-14T09:22:19Z","modified":"2024-08-03T07:39:51Z","updated_at":"2026-11-03T03:25:31.965622Z"}],"ghsa":[{"id":"GHSA-v9xm-x7mc-f74g","title":"A vulnerability has been identified in Mendix SAML Module (Mendix 7 compatible) (All versions \u003c...","description":"A vulnerability has been identified in Mendix SAML Module (Mendix 7 compatible) (All versions \u003c V1.16.6), Mendix SAML Module (Mendix 8 compatible) (All versions \u003c V2.2.2), Mendix SAML Module (Mendix 9 compatible) (All versions \u003c V3.2.3). The affected module is vulnerable to XML External Entity (XXE) attacks due to insufficient input sanitation. This may allow an attacker to disclose confidential data under certain circumstances.","status":"published","published":"2022-06-15T00:00:29Z","modified":"2023-01-27T05:04:42Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:42:31.605047Z"}],"nvd":[{"id":"CVE-2022-32285","description":"A vulnerability has been identified in Mendix SAML Module (Mendix 7 compatible) (All versions \u003c V1.16.6), Mendix SAML Module (Mendix 8 compatible) (All versions \u003c V2.2.2), Mendix SAML Module (Mendix 9 compatible) (All versions \u003c V3.2.3). The affected module is vulnerable to XML External Entity (XXE) attacks due to insufficient input sanitation. This may allow an attacker to disclose confidential data under certain circumstances.","status":"published","published":"2022-06-14T10:15:21.32Z","modified":"2026-06-17T04:47:03.883Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:07:22.232533Z"}]}}