CVE-2024-39888
High
Description
A vulnerability has been identified in Mendix Encryption (All versions >= V10.0.0 < V10.0.2). Affected versions of the module define a specific hard-coded default value for the EncryptionKey constant, which is used in projects where no individual EncryptionKey was specified. This could allow to an attacker to decrypt any encrypted project data, as the default encryption key can be considered compromised.
SeverityHigh
CVSS7.5
Exploit probability—
ProductMendix Encryption
PublishedJul 9, 2024
First seenJul 9, 2024
Weakness typeCWE-547CWE-547
How to fix
Update
- Siemens Mendix EncryptionV10.0.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Siemens Mendix Encryption | V10.0.0 ≤ v < V10.0.2 | V10.0.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.