Vulnerability in Siemens Mendix
CVE-2023-45794
A vulnerability has been identified in Mendix Applications using Mendix 10 (All versions < V10.4.0), Mendix Applications using Mendix 7 (All versions < V7.23.37), Mendix Applications using Mendix 8 (All versions < V8.18.27), Mendix Applications using Mendix 9 (All versions < V9.24.10). A capture-replay flaw in the platform could have an impact to apps built with the platform, if certain preconditions are met that depend on the app's model and access control design. This could allow authenticated attackers to access or modify objects without proper authorization, or escalate privileges in the context of the vulnerable app.
EPSS: 0.004 (36.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N.
Affected products
- Siemens Mendix
- Siemens Mendix Applications Using 10 — versions All versions < V10.4.0
- Siemens Mendix Applications Using 7 — versions All versions < V7.23.37
- Siemens Mendix Applications Using 8 — versions All versions < V8.18.27
- Siemens Mendix Applications Using 9 — versions All versions < V9.24.10
Weakness classification (CWE)
References
- productcert@siemens.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2023-45794?
- CVE-2023-45794 is a medium-severity vulnerability in Siemens Mendix, classified under Authentication Bypass by Capture-replay. CVSS score: 6.8/10. Published 2023-11-14.
- How severe is CVE-2023-45794?
- Medium severity. CVSS v3 base score is 6.8 out of 10.