CVE-2022-34467 XML external entity in Mendix Excel Importer Module (Mendix 8 compatible)
An attacker can cause denial of service in Mendix Excel Importer Module via XML Entity Expansion Injection, requiring an upgrade to patched versions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-34467?
CVE-2022-34467 is a medium-severity vulnerability in Siemens Mendix Excel Importer Module (Mendix 8 compatible), published on 12 Jul 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability has been identified in Mendix Excel Importer Module (Mendix 8 compatible) (All versions < V9.2.2), Mendix Excel Importer Module (Mendix 9 compatible) (All versions < V10.1.2). The affected component is vulnerable to XML Entity Expansion Injection. An attacker may use this to compromise the availability of the affected component.
Weakness: CWE-776
Which versions are affected by CVE-2022-34467?
It affects 1 product.
Products include Mendix Excel Importer.
How do I fix CVE-2022-34467?
No fix has been published for CVE-2022-34467 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-34467 being exploited?
There is no known exploitation of CVE-2022-34467 in the wild and no public exploit code.
Other vulnerabilities in Siemens Mendix Excel Importer Module (Mendix 8 compatible)
Sources
Also known as GHSA-mhjg-98h7-6g9w.