Vulnerability · Published Apr 8, 2025 · Assigned by siemens
CVE-2025-30280
Medium 5.3
In plain English
A medium-severity security flaw in Mendix Runtime V10 from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).
Official description
A vulnerability has been identified in Mendix Runtime V10 (All versions < V10.21.0), Mendix Runtime V10.12 (All versions < V10.12.16), Mendix Runtime V10.18 (All versions < V10.18.5), Mendix Runtime V10.6 (All versions < V10.6.22), Mendix Runtime V8 (All versions < V8.18.35), Mendix Runtime V9 (All versions < V9.24.34). Affected applications allow for entity enumeration due to distinguishable responses in certain client actions. This could allow an unauthenticated remote attacker to list all valid entities and attribute names of a Mendix Runtime-based application.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Siemens | Mendix Runtime V10 | 0 – before V10.21.0 |
| Siemens | Mendix Runtime V10.12 | 0 – before V10.12.16 |
| Siemens | Mendix Runtime V10.18 | 0 – before V10.18.5 |
| Siemens | Mendix Runtime V10.6 | 0 – before V10.6.22 |
| Siemens | Mendix Runtime V8 | 0 – before V8.18.35 |
| Siemens | Mendix Runtime V9 | 0 – before V9.24.34 |
Weakness: CWE-204 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N