Summary
Mendix Runtime contains an observable response discrepancy vulnerability when validating usernames during authentication. This could allow unauthenticated remote attackers to distinguish between valid and invalid usernames.
Siemens has released new versions for the affected products and recommends to update to the latest versions.
Vulnerabilities 1
-
Medium 5.3
A vulnerability has been identified in Mendix Runtime V10 (All versions < V10.17.0 only if the basic authentication mec…
Revision history
-
#10
Added mitigation for published REST and web services and oData APIs
-
#9
Added complete fix for Mendix Runtime V10.12 and V10.6; removed hint about additional required actions in former (incomplete) fix versions
-
#8
Added complete fix for Mendix Runtime V9 and V8
-
#7
Added complete fix for Mendix Runtime V10 and the note that other versions still require additional actions after updating to the latest available version
-
#6
Added information about additional required actions after having installed a fix release
-
#5
Added fix releases for remaining Mendix Runtime version lines
-
#4
Corrected fix version information for all Mendix Runtime version lines (fix releases not yet available, except for V8)
-
#3
Fixed a bug in the csaf output
-
#2
Added fix for Mendix Runtime V8; updated Acknowledgements
-
#1
Publication Date
References
-
SSA-097435: Usernames Disclosure Vulnerability in Mendix Runtime - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-097435.html