Vulnerability in Mendix
CVE-2024-50313
A vulnerability has been identified in Mendix Runtime V10 (All versions < V10.16.0 only if the basic authentication mechanism is used by the application), Mendix Runtime V10.12 (All versions < V10.12.7 only if the basic authentication mechanism is used by the application), Mendix Runtime V10.6 (All versions < V10.6.15 only if the basic authentication mechanism is used by the application), Mendix Runtime V8 (All versions only if the basic authentication mechanism is used by the application), Mendix Runtime V9 (All versions < V9.24.29 only if the basic authentication mechanism is used by the application). The basic authentication implementation of affected applications contains a race condition vulnerability which could allow unauthenticated remote attackers to circumvent default account lockout measures.
Vulnerability class: Race Condition
EPSS: 0.003 (18.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.
Affected products
- Mendix
- Siemens Mendix Runtime V10 — versions 0
- Siemens Mendix Runtime V10.12 — versions 0
- Siemens Mendix Runtime V10.6 — versions 0
- Siemens Mendix Runtime V8 — versions 0
- Siemens Mendix Runtime V9 — versions 0
Weakness classification (CWE)
References
- productcert@siemens.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2024-50313?
- CVE-2024-50313 is a medium-severity vulnerability in Mendix, classified under Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). CVSS score: 5.3/10. Published 2024-11-12.
- How severe is CVE-2024-50313?
- Medium severity. CVSS v3 base score is 5.3 out of 10.