Threat Investigation
Request a demo

CVE-2023-49069

Medium

Description

A vulnerability has been identified in Mendix Runtime V10 (All versions < V10.17.0 only if the basic authentication mechanism is used by the application), Mendix Runtime V10.12 (All versions < V10.12.11 only if the basic authentication mechanism is used by the application), Mendix Runtime V10.6 (All versions < V10.6.19 only if the basic authentication mechanism is used by the application), Mendix Runtime V8 (All versions < V8.18.33 only if the basic authentication mechanism is used by the application), Mendix Runtime V9 (All versions < V9.24.31 only if the basic authentication mechanism is used by the application). The authentication mechanism of affected applications contains an observable response discrepancy vulnerability when validating usernames. This could allow unauthenticated remote attackers to distinguish between valid and invalid usernames.

SeverityMedium
CVSS5.3
Exploit probability—
ProductMendix Runtime V10
PublishedSep 10, 2024
First seenSep 10, 2024
Weakness typeCWE-204CWE-204

How to fix

Update
  • Siemens Mendix Runtime V10V10.17.0 or later
  • Siemens Mendix Runtime V10.12V10.12.11 or later
  • Siemens Mendix Runtime V10.6V10.6.19 or later
  • Siemens Mendix Runtime V8V8.18.33 or later
  • Siemens Mendix Runtime V9V9.24.31 or later

Affected products

ProductAffected versionsFixed in
Siemens Mendix Runtime V10v < V10.17.0V10.17.0
Siemens Mendix Runtime V10.12v < V10.12.11V10.12.11
Siemens Mendix Runtime V10.6v < V10.6.19V10.6.19
Siemens Mendix Runtime V8v < V8.18.33V8.18.33
Siemens Mendix Runtime V9v < V9.24.31V9.24.31

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.