Vulnetix
Try Vulnetix Request Demo
CVE-2023-49069 PUBLISHED CVSS 5.300000190734863 MEDIUM

A vulnerability has been identified in Mendix Runtime V10 (All versions < V10.14.0 only if the basic authentication mechanism is used by the application), Mendix Runtime V10.12 (All versions < V10.12.2 only if the basic authentication mechanism is used by the application), Mendix Runtime V10.6 (All versions < V10.6.12 only if the basic authentication mechanism is used by the application), Mendix Runtime V8 (All versions only if the basic authentication mechanism is used by the application), Mendix Runtime V9 (All versions < V9.24.26 only if the basic authentication mechanism is used by the application). The authentication mechanism of affected applications contains an observable response discrepancy vulnerability when validating usernames. This could allow unauthenticated remote attackers to distinguish between valid and invalid usernames.

EPSS 0.35% · 57.3th percentile

Risk Scores

CVSS v3.1
5.300000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS Score
0.35%
57.3th percentile

Affected Products

VendorProductVersions
SiemensMendix Runtime V80
SiemensMendix Runtime V90
SiemensMendix Runtime V10.60
SiemensMendix Runtime V10.120
siemensmendix10.13, 8.0, 10.0
SiemensMendix Runtime V100

Timeline

References

Open in Interactive Console →