Full Report
Mendix RichText editor contain a cross-site scripting vulnerability. Siemens has released a new version for Mendix RichText and recommends to update to the latest version.
Analysis Summary
# Vulnerability: Cross-Site Scripting in Mendix Rich Text Widget
## CVE Details
- **CVE ID:** CVE-2025-40834
- **CVSS Score:** 5.7 (Medium) via CVSS v3.1 / 6.8 (Medium) via CVSS v4.0
- **CWE:** CWE-79 (Improper Neutralization of Input During Web Page Generation)
## Affected Systems
- **Products:** Mendix RichText Widget
- **Versions:** All versions from V4.0.0 up to (but excluding) V4.6.1.
- **Configurations:** Systems utilizing this widget to generate rich formatted text with HTML output.
## Vulnerability Description
The affected Mendix RichText widget fails to properly neutralize user-provided input. Because the widget is designed to handle HTML output, the lack of rigorous sanitization allows an attacker to inject malicious scripts into web pages. When a victim views the affected page, the script executes within the context of the victim's browser session.
## Exploitation
- **Status:** Not exploited (No known public PoC or active exploitation reported in advisory).
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
- **Requirements:** The attacker requires low privileges (PR:L) to submit input, and user interaction (UI:R/UI:A) is required from a victim to trigger the script execution.
## Impact
- **Confidentiality:** High (Session tokens, cookies, and sensitive page data can be accessed).
- **Integrity:** None (Based on CVSS vector, though XSS typically allows for localized data manipulation).
- **Availability:** None
## Remediation
### Patches
- **Mendix RichText V4.6.1:** Siemens recommends updating the widget to version V4.6.1 or later via the Mendix Marketplace.
### Workarounds
- No specific technical workaround provided for the widget itself.
- **General Mitigation:** Follow Siemens' operational guidelines for Industrial Security and ensure network access to the application is restricted to authorized users only.
## Detection
- **Indicators of Compromise:** Presence of unexpected `<script>` tags or unusual HTML event handlers (e.g., `onerror`, `onload`) within data processed by the RichText widget.
- **Detection Methods:** Web Application Firewall (WAF) logs may show XSS payload attempts (e.g., `<script>alert(1)</script>`) targeting Mendix application endpoints.
## References
- **Siemens Advisory:** hxxps://cert-portal.siemens[.]com/productcert/pdf/ssa-190588.pdf
- **Mendix Marketplace:** hxxps://marketplace.mendix[.]com/link/component/74889
- **Siemens Industrial Security:** hxxps://www.siemens[.]com/industrialsecurity