Skip to content
OpenAdvisories
Critical SSA-851884 2 CVEs

SSA-851884: Authentication Bypass Vulnerability in Mendix SAML Module

Published Mar 14, 2023 · Updated Aug 8, 2023 · Revision 3

Vendor: Siemens Product: Mendix SAML (Mendix 7 compatible) Product: Mendix SAML (Mendix 8 compatible) Product: Mendix SAML (Mendix 9 latest compatible, New Track) Product: Mendix SAML (Mendix 9 latest compatible, Upgrade Track) Product: Mendix SAML (Mendix 9.12/9.18 compatible, New Track) Product: Mendix SAML (Mendix 9.12/9.18 compatible, Upgrade Track) Product: Mendix SAML (Mendix 9.6 compatible, New Track) Product: Mendix SAML (Mendix 9.6 compatible, Upgrade Track)

Summary

The Mendix SAML module insufficiently verifies the SAML assertions. This could allow unauthenticated remote attackers to bypass authentication and get access to the application.

Mendix has provided fix releases for the Mendix SAML module and recommends to update to the latest version.

Note: For compatibility reasons, fixes for several versions of the Mendix SAML module were introduced in two release steps:

-
The first fix versions address CVE-2023-25957. It removes the vulnerability, except when the recommended, default configuration option
'Use Encryption' is disabled.

-
The second fix versions address CVE-2023-29129, which removes the issue for the non default configuration as well.

Vulnerabilities 2

Revision history

  1. #3

    Added additional release versions of Mendix SAML, where the fixes have been included

  2. #2

    Added CVE-2023-29129 and the fix information also for non default configurations

  3. #1

    Publication Date

References