Vigie VulnDBEuropean-hosted Vulnerability DB
FR
Menu

Siemens Mendix SAML (Mendix 7 compatible)

CVE-2023-29129
CRITICAL 9.1

At a glance

Source
NVD
EPSS
EPSS 0.89 % · percentile 59 ()
State
PUBLISHED
Published
Updated
Assigner
siemens
NVD status
Modified

Search on…

Description

A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.17.3 < V1.18.0), Mendix SAML (Mendix 7 compatible) (All versions >= V1.16.4 < V1.17.3), Mendix SAML (Mendix 8 compatible) (All versions >= V2.3.0 < V2.4.0), Mendix SAML (Mendix 8 compatible) (All versions >= V2.2.0 < V2.3.0), Mendix SAML (Mendix 9 latest compatible, New Track) (All versions >= V3.3.1 < V3.6.1), Mendix SAML (Mendix 9 latest compatible, New Track) (All versions >= V3.1.9 < V3.3.1), Mendix SAML (Mendix 9 latest compatible, Upgrade Track) (All versions >= V3.3.0 < V3.6.0), Mendix SAML (Mendix 9 latest compatible, Upgrade Track) (All versions >= V3.1.8 < V3.3.0), Mendix SAML (Mendix 9.12/9.18 compatible, New Track) (All versions >= V3.3.1 < V3.3.15), Mendix SAML (Mendix 9.12/9.18 compatible, Upgrade Track) (All versions >= V3.3.0 < V3.3.14), Mendix SAML (Mendix 9.6 compatible, New Track) (All versions >= V3.1.9 < V3.2.7), Mendix SAML (Mendix 9.6 compatible, Upgrade Track) (All versions >= V3.1.8 < V3.2.6). The affected versions of the module insufficiently verify the SAML assertions. This could allow unauthenticated remote attackers to bypass authentication and get access to the application. This CVE entry describes the incomplete fix for CVE-2023-25957 in a specific non default configuration.

Weaknesses (CWE)

  • CWE-303 — Incorrect Implementation of Authentication Algorithm
  • CWE-287 — Improper Authentication

References

Scores

VersionScoreVectorScored by
CVSS 3.1CRITICAL 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:Csiemens
CVSS 3.1CRITICAL 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NNVD · productcert@siemens.com (Secondary)
CVSS 3.1CRITICAL 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HNVD · nvd@nist.gov (Primary)

European references

Affected configurations (NVD CPE)

Affected products

ProductVersions
Siemens · Mendix SAML (Mendix 7 compatible)affected All versions >= V1.17.3 < V1.18.0
Siemens · Mendix SAML (Mendix 7 compatible)affected All versions >= V1.16.4 < V1.17.3
Siemens · Mendix SAML (Mendix 8 compatible)affected All versions >= V2.3.0 < V2.4.0
Siemens · Mendix SAML (Mendix 8 compatible)affected All versions >= V2.2.0 < V2.3.0
Siemens · Mendix SAML (Mendix 9 latest compatible, New Track)affected All versions >= V3.3.1 < V3.6.1
Siemens · Mendix SAML (Mendix 9 latest compatible, New Track)affected All versions >= V3.1.9 < V3.3.1
Siemens · Mendix SAML (Mendix 9 latest compatible, Upgrade Track)affected All versions >= V3.3.0 < V3.6.0
Siemens · Mendix SAML (Mendix 9 latest compatible, Upgrade Track)affected All versions >= V3.1.8 < V3.3.0
Siemens · Mendix SAML (Mendix 9.12/9.18 compatible, New Track)affected All versions >= V3.3.1 < V3.3.15
Siemens · Mendix SAML (Mendix 9.12/9.18 compatible, Upgrade Track)affected All versions >= V3.3.0 < V3.3.14
Siemens · Mendix SAML (Mendix 9.6 compatible, New Track)affected All versions >= V3.1.9 < V3.2.7
Siemens · Mendix SAML (Mendix 9.6 compatible, Upgrade Track)affected All versions >= V3.1.8 < V3.2.6

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD