PT-2023-21146 · Mendix · Mendix Forgot Password

CVE-2023-27464 · Publicado 2023-04-11 · Atualizado 2023-04-19

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mendix Forgot Password (Mendix 7 compatible) versions prior to V3.7.1 Mendix Forgot Password (Mendix 8 compatible) versions prior to V4.1.1 Mendix Forgot Password (Mendix 9 compatible) versions prior to V5.1.1

Description The affected versions of the module contain an observable response discrepancy issue that could allow an attacker to retrieve sensitive information.

Recommendations For Mendix Forgot Password (Mendix 7 compatible) versions prior to V3.7.1, update to version V3.7.1 or later. For Mendix Forgot Password (Mendix 8 compatible) versions prior to V4.1.1, update to version V4.1.1 or later. For Mendix Forgot Password (Mendix 9 compatible) versions prior to V5.1.1, update to version V5.1.1 or later.

Correção

Side Channel Attack

Enumeração de Fraquezas

CWE-203

CWE-204

Identificadores relacionados

CVE-2023-27464

Produtos afetados

Mendix Forgot Password

Referências · 4

• https://cert-portal.siemens.com/productcert/pdf/ssa-699404.pdf · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-27464 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-27464 · Aviso do Fabricante
• https://t.me/cibsecurity/61841 · Publicação no Telegram