PT-2023-1689 · Mendix · Mendix Saml

CVE-2023-25957 · Publicado 2023-03-14 · Atualizado 2023-08-08

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Mendix SAML (Mendix 7 compatible) versions 1.16.4 through 1.17.3 Mendix SAML (Mendix 8 compatible) versions 2.2.0 through 2.3.0 Mendix SAML (Mendix 9 latest compatible, New Track) versions 3.1.9 through 3.3.1 Mendix SAML (Mendix 9 latest compatible, Upgrade Track) versions 3.1.8 through 3.3.0 Mendix SAML (Mendix 9.6 compatible, New Track) versions 3.1.9 through 3.2.7 Mendix SAML (Mendix 9.6 compatible, Upgrade Track) versions 3.1.8 through 3.2.6

Description The issue is related to insufficient verification of SAML assertions in the affected versions of the Mendix SAML module. This could allow unauthenticated remote attackers to bypass authentication and gain access to the application. The vulnerability is connected to errors in the implementation of the authentication algorithm.

Recommendations For Mendix SAML (Mendix 7 compatible) versions 1.16.4 through 1.17.3, update to a version outside of this range. For Mendix SAML (Mendix 8 compatible) versions 2.2.0 through 2.3.0, update to a version outside of this range. For Mendix SAML (Mendix 9 latest compatible, New Track) versions 3.1.9 through 3.3.1, update to a version outside of this range. For Mendix SAML (Mendix 9 latest compatible, Upgrade Track) versions 3.1.8 through 3.3.0, update to a version outside of this range. For Mendix SAML (Mendix 9.6 compatible, New Track) versions 3.1.9 through 3.2.7, update to a version outside of this range. For Mendix SAML (Mendix 9.6 compatible, Upgrade Track) versions 3.1.8 through 3.2.6, update to a version outside of this range. As a temporary workaround, consider enabling the recommended configuration option Use Encryption to mitigate the risk of exploitation.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-303

CWE-287

Identificadores relacionados

BDU:2023-01260

CVE-2023-25957

Produtos afetados

Mendix Saml

Referências · 4

• https://bdu.fstec.ru/vul/2023-01260 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-25957 · Nota de Segurança
• https://cert-portal.siemens.com/productcert/pdf/ssa-851884.pdf · Nota
• https://osv.dev/vulnerability/CVE-2023-25957 · Aviso do Fabricante