Summary
The basic authentication mechanism of Mendix Runtime contains a race condition vulnerability which could allow unauthenticated remote attackers to circumvent default account lockout measures.
Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.
Vulnerabilities 1
-
Medium 5.3
A vulnerability has been identified in Mendix Runtime V10 (All versions < V10.16.0 only if the basic authentication mec…
Revision history
-
#2
Added mitigation for published REST and web services and oData APIs
-
#1
Publication Date
References
-
SSA-914892: Race Condition Vulnerability in Basic Authentication Implementation of Mendix Runtime - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-914892.html