CVE-2022-37011

A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions < V1.17.0), Mendix SAML (Mendix 8 compatible) (All versions < V2.3.0), Mendix SAML (Mendix 9 compatible, New Track) (All versions < V3.3.1), Mendix SAML (Mendix 9 compatible, Upgrade Track) (All versions < V3.3.0). Affected versions of the module insufficiently protect from packet capture replay. This could allow unauthorized remote attackers to bypass authentication and get access to the application. For compatibility reasons, fix versions still contain this issue, but only when the not recommended, non default configuration option `'Allow Idp Initiated Authentication'` is enabled.

• CWE-294

• https://cert-portal.siemens.com/productcert/pdf/ssa-638652.pdfPatch, Third Party Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-638652.pdfPatch, Third Party Advisory

Published

Sep 13, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-37006Permission control vulnerability in the network module. Succ…7.5
• CVE-2022-37007The chinadrm module has an out-of-bounds read vulnerability.…7.5
• CVE-2022-37008The recovery module has a vulnerability of bypassing the ver…7.5
• CVE-2022-37009In JetBrains IntelliJ IDEA before 2022.2 local code executio…7.8
• CVE-2022-3701 A privilege elevation vulnerability was reported in the Len…7.8
• CVE-2022-37010In JetBrains IntelliJ IDEA before 2022.2 email address valid…3.3
• CVE-2022-37012This vulnerability allows remote attackers to create a denia…7.5
• CVE-2022-37013This vulnerability allows remote attackers to create a denia…7.5
• CVE-2022-37015Symantec Endpoint Detection and Response (SEDR) Appliance, p…9.8
• CVE-2022-37016Symantec Endpoint Protection (Windows) agent may be suscepti…9.8
• CVE-2022-37017Symantec Endpoint Protection (Windows) agent, prior to 14.3 …7.5
• CVE-2022-37018A potential vulnerability has been identified in the system …8.4