Vulnerability · Published Jul 9, 2024 · Assigned by siemens
CVE-2024-39888
High 7.5
In plain English
A high-severity security flaw in Mendix Encryption from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).
Official description
A vulnerability has been identified in Mendix Encryption (All versions >= V10.0.0 < V10.0.2). Affected versions of the module define a specific hard-coded default value for the EncryptionKey constant, which is used in projects where no individual EncryptionKey was specified. This could allow to an attacker to decrypt any encrypted project data, as the default encryption key can be considered compromised.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Siemens | Mendix Encryption | V10.0.0 – before V10.0.2 |
Weakness: CWE-547 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N