CVE-2022-25650

A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.27), Mendix Applications using Mendix 8 (All versions < V8.18.14), Mendix Applications using Mendix 9 (All versions < V9.12.0), Mendix Applications using Mendix 9 (V9.6) (All versions < V9.6.3). When querying the database, it is possible to sort the results using a protected field. With this an authenticated attacker could extract information about the contents of a protected field.

• CWE-284

• https://cert-portal.siemens.com/productcert/pdf/ssa-870917.pdfMitigation, Patch, Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-870917.pdfMitigation, Patch, Vendor Advisory

Published

Apr 12, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-25645All versions of package dset are vulnerable to Prototype Pol…8.1
• CVE-2022-25646All versions of package x-data-spreadsheet are vulnerable to…6.1
• CVE-2022-25647The package com.google.code.gson:gson before 2.8.9 are vulne…7.5
• CVE-2022-25648The package git before 1.11.0 are vulnerable to Command Inje…9.8
• CVE-2022-25649Multiple Improper Access Control vulnerabilities in StoreApp…8.8
• CVE-2022-2565The Simple Payment Donations & Subscriptions WordPress plugi…7.2
• CVE-2022-25651Memory corruption in bluetooth host due to integer overflow …9.8
• CVE-2022-25652Cryptographic issues in BSP due to improper hash verificatio…7.8
• CVE-2022-25653Information disclosure in video due to buffer over-read whil…5.5
• CVE-2022-25654Memory corruption in kernel due to improper input validation…6.7
• CVE-2022-25655Memory corruption in WLAN HAL while arbitrary value is passe…7.8
• CVE-2022-25656Possible integer overflow and memory corruption due to impro…7.8