SSA-998949 — Vulnetix

SSA-998949 PUBLISHED CVSS 7.5 HIGH

The Mendix Encryption module versions V10.0.0 and V10.0.1 define a specific hard-coded default value for the EncryptionKey constant, which is used in projects where no individual EncryptionKey was specified. This could allow to an attacker to decrypt any encrypted project data, as the default encryption key can be considered compromised. Siemens has released a new version for Mendix Encryption and recommends to update to the latest version.

Risk Scores

CVSS 3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected Products

Vendor	Product	Versions
	Mendix Encryption

Exploit Intelligence

https://cert-portal.siemens.com/productcert/html/ssa-998949.html (circl)
https://cert-portal.siemens.com/productcert/csaf/ssa-998949.json (circl)
https://cert-portal.siemens.com/productcert/pdf/ssa-998949.pdf (circl)
https://cert-portal.siemens.com/productcert/txt/ssa-998949.txt (circl)

Timeline

Jul 9, 2024 CVE Published

References

https://cert-portal.siemens.com/productcert/html/ssa-998949.html advisory
https://cert-portal.siemens.com/productcert/csaf/ssa-998949.json advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-998949.pdf advisory
https://cert-portal.siemens.com/productcert/txt/ssa-998949.txt advisory

Open in Interactive Console →