PT-2025-3341 · Mendix · Mendix Ldap

Publicado 2025-01-14 · Atualizado 2025-01-14 · CVE-2024-56841

Positive Technologies (AI Summary)

CVSS v4.0

9.1

Crítica

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Mendix LDAP versions prior to V1.1.2

Description The issue is related to the Mendix LDAP module, which is vulnerable to LDAP injection due to the failure to neutralize special elements in the LDAP request. This could allow an unauthenticated remote attacker to bypass username verification. The vulnerability may be exploited by a remote attacker to bypass security restrictions.

Recommendations For versions prior to V1.1.2, update to version V1.1.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the LDAP module to minimize the risk of exploitation. Avoid using the vulnerable module until the issue is resolved.

Correção

Enumeração de Fraquezas

CWE-90

Identificadores relacionados

BDU:2025-01563

CVE-2024-56841

Produtos afetados

Mendix Ldap

Referências · 8

• https://twitter.com/CVEnew/status/1879118915479183787 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2025-01563 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1879152087981809682 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/1879121815278129602 · Publicação no Twitter
• https://cert-portal.siemens.com/productcert/html/ssa-314390.html# · Nota
• https://cert-portal.siemens.com/productcert/html/ssa-314390.html · Nota
• https://t.me/cvedetector/15244 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2024-56841 · Nota de Segurança