Description
A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions >= V3.3.0 < V3.5.1), Mendix Forgot Password Appstore module (Mendix 7 compatible) (All versions < V3.2.2). Initial passwords are generated in an insecure manner. This could allow an unauthenticated remote attacker to efficiently brute force passwords in specific situations.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Siemens | Mendix Forgot Password Appstore module | All versions >= V3.3.0 < V3.5.1 | — |
| Siemens | Mendix Forgot Password Appstore module (Mendix 7 compatible) | All versions < V3.2.2 | — |
Advisories 2
- ICSA-22-069-04 Siemens SINEMA Mendix Forgot Password Appstore CISA ICS & IT advisories · May 6, 2025
- SSA-134279 SSA-134279: Vulnerability in Mendix Forgot Password Appstore module Siemens ProductCERT · Mar 8, 2022