Vulnerability in Siemens Mendix Runtime V10
CVE-2023-49069
A vulnerability has been identified in Mendix Runtime V10 (All versions < V10.17.0 only if the basic authentication mechanism is used by the application), Mendix Runtime V10.12 (All versions < V10.12.11 only if the basic authentication mechanism is used by the application), Mendix Runtime V10.6 (All versions < V10.6.19 only if the basic authentication mechanism is used by the application), Mendix Runtime V8 (All versions < V8.18.33 only if the basic authentication mechanism is used by the application), Mendix Runtime V9 (All versions < V9.24.31 only if the basic authentication mechanism is used by the application). The authentication mechanism of affected applications contains an observable response discrepancy vulnerability when validating usernames. This could allow unauthenticated remote attackers to distinguish between valid and invalid usernames.
EPSS: 0.004 (36.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Siemens Mendix Runtime V10 — versions 0
- Siemens Mendix Runtime V10.12 — versions 0
- Siemens Mendix Runtime V10.6 — versions 0
- Siemens Mendix Runtime V8 — versions 0
- Siemens Mendix Runtime V9 — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
Frequently asked questions
- What is CVE-2023-49069?
- CVE-2023-49069 is a medium-severity vulnerability in Siemens Mendix Runtime V10, classified under Observable Response Discrepancy. CVSS score: 5.3/10. Published 2024-09-10.
- How severe is CVE-2023-49069?
- Medium severity. CVSS v3 base score is 5.3 out of 10.
- Is CVE-2023-49069 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.