Description
A vulnerability has been identified in Mendix Encryption (All versions >= V10.0.0 < V10.0.2). Affected versions of the module define a specific hard-coded default value for the EncryptionKey constant, which is used in projects where no individual EncryptionKey was specified.
This could allow to an attacker to decrypt any encrypted project data, as the default encryption key can be considered compromised.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Siemens | Mendix Encryption | V10.0.0 – < V10.0.2 | V10.0.2 |
Advisories 3
- NCSC-2024-0282 Kwetsbaarheden verholpen in Siemens Producten NCSC-NL (Netherlands) · Jul 9, 2024
- ICSA-24-193-08 Siemens Mendix Encryption Module CISA ICS & IT advisories · Jul 9, 2024
- SSA-998949 SSA-998949: Hard-coded Default Encryption Key in Mendix Encryption Module V10.0.0 and V10.0.1 Siemens ProductCERT · Jul 9, 2024