PT-2025-3341 · Mendix · Mendix Ldap

Published 2025-01-14 · Updated 2025-01-14 · CVE-2024-56841

Positive Technologies (AI Summary)

CVSS v4.0

9.1

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Mendix LDAP versions prior to V1.1.2

Description The issue is related to the Mendix LDAP module, which is vulnerable to LDAP injection due to the failure to neutralize special elements in the LDAP request. This could allow an unauthenticated remote attacker to bypass username verification. The vulnerability may be exploited by a remote attacker to bypass security restrictions.

Recommendations For versions prior to V1.1.2, update to version V1.1.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the LDAP module to minimize the risk of exploitation. Avoid using the vulnerable module until the issue is resolved.

Fix

Weakness Enumeration

CWE-90

Related Identifiers

BDU:2025-01563

CVE-2024-56841

Affected Products

Mendix Ldap

References · 8

• https://bdu.fstec.ru/vul/2025-01563 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-56841 · Security Note
• https://twitter.com/CVEnew/status/1879118915479183787 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1879152087981809682 · Twitter Post
• https://twitter.com/CveFindCom/status/1879121815278129602 · Twitter Post
• https://cert-portal.siemens.com/productcert/html/ssa-314390.html# · Note
• https://cert-portal.siemens.com/productcert/html/ssa-314390.html · Note
• https://t.me/cvedetector/15244 · Telegram Post