« Volver al listado

CVE-2022-34467

Estado: ModificadaMedia (6.5)—

A vulnerability has been identified in Mendix Excel Importer Module (Mendix 8 compatible) (All versions < V9.2.2), Mendix Excel Importer Module (Mendix 9 compatible) (All versions < V10.1.2). The affected component is vulnerable to XML Entity Expansion Injection. An attacker may use this to compromise the availability of the affected component.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mendix — Excel Importer

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-34467",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "productcert@siemens.com",
      "affectedData": [
        {
          "vendor": "Siemens",
          "product": "Mendix Excel Importer Module (Mendix 8 compatible)",
          "versions": [
            {
              "status": "affected",
              "version": "All versions < V9.2.2"
            }
          ]
        },
        {
          "vendor": "Siemens",
          "product": "Mendix Excel Importer Module (Mendix 9 compatible)",
          "versions": [
            {
              "status": "affected",
              "version": "All versions < V10.1.2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-07-12T10:15:12.137",
  "references": [
    {
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-610768.pdf",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "productcert@siemens.com"
    },
    {
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-610768.pdf",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "productcert@siemens.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-776"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-776"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability has been identified in Mendix Excel Importer Module (Mendix 8 compatible) (All versions < V9.2.2), Mendix Excel Importer Module (Mendix 9 compatible) (All versions < V10.1.2). The affected component is vulnerable to XML Entity Expansion Injection. An attacker may use this to compromise the availability of the affected component."
    },
    {
      "lang": "es",
      "value": "Se ha identificado una vulnerabilidad en el Módulo Importador de Excel de Mendix (compatible con Mendix 8) (Todas las versiones anteriores a V9.2.2), Módulo Importador de Excel de Mendix (compatible con Mendix 9) (Todas las versiones anteriores a V10.1.2). El componente afectado es vulnerable a una inyección de expansión de entidades XML. Un atacante puede usar esto para comprometer la disponibilidad del componente afectado"
    }
  ],
  "lastModified": "2026-06-17T04:50:24.420",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mendix:excel_importer:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6D3FD506-1CA7-466C-B4D2-64DAE1B1D4DE",
              "versionEndExcluding": "9.2.2"
            },
            {
              "criteria": "cpe:2.3:a:mendix:excel_importer:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7ED81B7E-51AA-4350-91A6-9638D036908D",
              "versionEndExcluding": "10.1.2",
              "versionStartIncluding": "10.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "productcert@siemens.com"
}