PT-2023-3305 · Mendix · Mendix Saml

Published 2023-03-14 · Updated 2023-08-08 · CVE-2023-29129

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mendix SAML (Mendix 7 compatible) versions 1.16.4 through 1.18.0 Mendix SAML (Mendix 8 compatible) versions 2.2.0 through 2.4.0 Mendix SAML (Mendix 9 latest compatible, New Track) versions 3.1.9 through 3.6.1 Mendix SAML (Mendix 9 latest compatible, Upgrade Track) versions 3.1.8 through 3.6.0 Mendix SAML (Mendix 9.12/9.18 compatible, New Track) versions 3.3.1 through 3.3.15 Mendix SAML (Mendix 9.12/9.18 compatible, Upgrade Track) versions 3.3.0 through 3.3.14 Mendix SAML (Mendix 9.6 compatible, New Track) versions 3.1.9 through 3.2.7 Mendix SAML (Mendix 9.6 compatible, Upgrade Track) versions 3.1.8 through 3.2.6

Description The issue is related to insufficient verification of SAML assertions in the affected versions of the Mendix SAML module. This could allow unauthenticated remote attackers to bypass authentication and gain access to the application. The vulnerability is associated with errors in the implementation of the authentication algorithm.

Recommendations For Mendix SAML (Mendix 7 compatible) versions 1.16.4 through 1.18.0, update to a version outside of this range to resolve the issue. For Mendix SAML (Mendix 8 compatible) versions 2.2.0 through 2.4.0, update to a version outside of this range to resolve the issue. For Mendix SAML (Mendix 9 latest compatible, New Track) versions 3.1.9 through 3.6.1, update to a version outside of this range to resolve the issue. For Mendix SAML (Mendix 9 latest compatible, Upgrade Track) versions 3.1.8 through 3.6.0, update to a version outside of this range to resolve the issue. For Mendix SAML (Mendix 9.12/9.18 compatible, New Track) versions 3.3.1 through 3.3.15, update to a version outside of this range to resolve the issue. For Mendix SAML (Mendix 9.12/9.18 compatible, Upgrade Track) versions 3.3.0 through 3.3.14, update to a version outside of this range to resolve the issue. For Mendix SAML (Mendix 9.6 compatible, New Track) versions 3.1.9 through 3.2.7, update to a version outside of this range to resolve the issue. For Mendix SAML (Mendix 9.6 compatible, Upgrade Track) versions 3.1.8 through 3.2.6, update to a version outside of this range to resolve the issue.

Fix

Improper Authentication

Weakness Enumeration

CWE-303

CWE-287

Related Identifiers

BDU:2023-03449

CVE-2023-29129

Affected Products

Mendix Saml

References · 6

• https://cert-portal.siemens.com/productcert/pdf/ssa-851884.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-29129 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-29129 · Security Note
• https://bdu.fstec.ru/vul/2023-03449 · Security Note
• https://vuldb.com/?id.231322 · Note
• https://cybersecurity-help.cz/vdb/SB2022051008 · Note