Vulnerability · Published Nov 14, 2023 · Assigned by siemens
CVE-2023-45794
Medium 6.8
In plain English
A medium-severity security flaw in Mendix Applications using Mendix 10 from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).
Official description
A vulnerability has been identified in Mendix Applications using Mendix 10 (All versions < V10.4.0), Mendix Applications using Mendix 7 (All versions < V7.23.37), Mendix Applications using Mendix 8 (All versions < V8.18.27), Mendix Applications using Mendix 9 (All versions < V9.24.10). A capture-replay flaw in the platform could have an impact to apps built with the platform, if certain preconditions are met that depend on the app's model and access control design. This could allow authenticated attackers to access or modify objects without proper authorization, or escalate privileges in the context of the vulnerable app.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Siemens | Mendix Applications using Mendix 10 | All versions < V10.4.0 |
| Siemens | Mendix Applications using Mendix 7 | All versions < V7.23.37 |
| Siemens | Mendix Applications using Mendix 8 | All versions < V8.18.27 |
| Siemens | Mendix Applications using Mendix 9 | All versions < V9.24.10 |
Weakness: CWE-294 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C