CVE-2021-42026 Explained : Impact and Mitigation

A vulnerability has been identified in Mendix Applications that could potentially allow attackers to access certain client actions without proper authorization.

Understanding CVE-2021-42026

What is CVE-2021-42026?

This vulnerability affects Mendix Applications using Mendix 8 (All versions < V8.18.13) and Mendix Applications using Mendix 9 (All versions < V9.6.2). It allows authenticated attackers to retrieve specific object attributes without proper authorization.

The Impact of CVE-2021-42026

The vulnerability could enable attackers to access the 'changedDate' attribute of arbitrary objects, bypassing the intended access controls.

Technical Details of CVE-2021-42026

Vulnerability Description

The issue lies in the lack of proper access control for certain client actions in applications built with the affected versions of Mendix Studio Pro.

Affected Systems and Versions

Mendix Applications using Mendix 8: All versions prior to V8.18.13
Mendix Applications using Mendix 9: All versions prior to V9.6.2

Exploitation Mechanism

Attackers who are authenticated can exploit this vulnerability to access object attributes even when they lack the required read access.

Mitigation and Prevention

Immediate Steps to Take

Update Mendix Applications to the non-vulnerable versions (V8.18.13 or later for Mendix 8, and V9.6.2 or later for Mendix 9)
Implement strict access controls to limit unauthorized access

Long-Term Security Practices

Regularly review and update access control policies
Conduct security training for developers and administrators

Patching and Updates

Apply patches provided by Siemens to address the vulnerability