Read the docs
TI-2022-09695 Aliases CVE-2022-26314GHSA-v94f-h6hr-hfqh

Missing brute-force protection in Siemens Mendix Forgot Password Appstore module

Priority MEDIUM 45CWE-307Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-307.

Summary

A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions >= V3.3.0 < V3.5.1), Mendix Forgot Password Appstore module (Mendix 7 compatible) (All versions < V3.2.2). Initial passwords are generated in an insecure manner. This could allow an unauthenticated remote attacker to efficiently brute force passwords in specific situations.

Why it matters now

EPSS 0.01488 74th percentileScored 2026-11-07
Fix Fixed Mendix Forgot Password Appstore module (Mendix 7 compatible) (Siemens): V3.2.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensMendix Forgot Password Appstore moduleAll versions >= V3.3.0 < V3.5.1—No fix listedCNA
SiemensMendix Forgot Password Appstore module (Mendix 7 compatible)before V3.2.2V3.2.2Patch availableCNA
  • Mendix Forgot Password Appstore module VendorSiemens Affected All versions >= V3.3.0 < V3.5.1 Fixed in — No fix listed CNA
  • Mendix Forgot Password Appstore module (Mendix 7 compatible) VendorSiemens Affected before V3.2.2 Fixed in V3.2.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mendix:forgot_password:*:*:*:*:*:*:*:*before 3.2.2; 3.3.0 to before 3.5.1VulnerableMendix
  • cpe:2.3:a:mendix:forgot_password:*:*:*:*:*:*:*:* Versions before 3.2.2; 3.3.0 to before 3.5.1 Vulnerable ·Mendix

Remediation

  • Fix · CNA Mendix Forgot Password Appstore module (Mendix 7 compatible) (Siemens) Fixed in V3.2.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-26314
  2. 2026-10-03 Alias added: GHSA-v94f-h6hr-hfqh

References

Patch 1

  • TI-2026-20057 Authentication bypass in Fortinet FortiWeb KEVCVSS 3.1CRITICAL 9.4
  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-18911 Heap-based buffer overflow in Fortinet FortiSwitchManager KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
See all 2487 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences