PT-2023-7001 · Mendix · Mendix

Published 2023-11-14 · Updated 2023-12-28 · CVE-2023-45794

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Mendix Applications using Mendix 7 versions prior to 7.23.37 Mendix Applications using Mendix 8 versions prior to 8.18.27 Mendix Applications using Mendix 9 versions prior to 9.24.10 Mendix Applications using Mendix 10 versions prior to 10.4.0

Description A capture-replay flaw in the Mendix platform could allow authenticated attackers to access or modify objects without proper authorization, or escalate privileges in the context of the vulnerable app. This issue is related to bypassing authentication procedures and could impact the confidentiality, integrity, and availability of protected information.

Recommendations For Mendix 7 versions prior to 7.23.37, update to version 7.23.37 or later. For Mendix 8 versions prior to 8.18.27, update to version 8.18.27 or later. For Mendix 9 versions prior to 9.24.10, update to version 9.24.10 or later. For Mendix 10 versions prior to 10.4.0, update to version 10.4.0 or later.

Fix

Weakness Enumeration

CWE-294

Related Identifiers

BDU:2023-08020

CVE-2023-45794

Affected Products

Mendix

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-45794 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-084182.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-45794 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08020 · Security Note
• https://twitter.com/CVEnew/status/1724387627741118502 · Twitter Post
• https://vuldb.com/ru/?id.245150 · Note
• https://twitter.com/VulmonFeeds/status/1724429056341422491 · Twitter Post