CVE-2024-50313

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-50313
A vulnerability has been identified in Mendix Runtime V10 (All versions < V10.16.0 only if the basic authentication mechanism is used by the application), Mendix Runtime V10.12 (All versions < V10.12.7 only if the basic authentication mechanism is used by the application), Mendix Runtime V10.6 (All versions < V10.6.15 only if the basic authentication mechanism is used by the application), Mendix Runtime V8 (All versions), Mendix Runtime V9 (All versions < V9.24.29 only if the basic authentication mechanism is used by the application). The basic authentication implementation of affected applications contains a race condition vulnerability which could allow unauthenticated remote attackers to circumvent default account lockout measures.

4.8 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://cert-portal.siemens.com/productcert/html/ssa-914892.html Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:mendix:mendix:*:*:*:*:*:*:*:*
cpe:2.3:a:mendix:mendix:*:*:*:*:*:*:*:*
cpe:2.3:a:mendix:mendix:*:*:*:*:*:*:*:*
cpe:2.3:a:mendix:mendix:*:*:*:*:*:*:*:*
History

15 Nov 2024, 17:12

Type Values Removed Values Added
References () https://cert-portal.siemens.com/productcert/html/ssa-914892.html - () https://cert-portal.siemens.com/productcert/html/ssa-914892.html - Vendor Advisory
Summary
  • (es) Se ha identificado una vulnerabilidad en Mendix Runtime V10 (todas las versiones anteriores a la V10.16.0, solo si la aplicación utiliza el mecanismo de autenticación básica), Mendix Runtime V10.12 (todas las versiones anteriores a la V10.12.7, solo si la aplicación utiliza el mecanismo de autenticación básica), Mendix Runtime V10.6 (todas las versiones anteriores a la V10.6.15, solo si la aplicación utiliza el mecanismo de autenticación básica), Mendix Runtime V8 (todas las versiones), Mendix Runtime V9 (todas las versiones anteriores a la V9.24.29, solo si la aplicación utiliza el mecanismo de autenticación básica). La implementación de autenticación básica de las aplicaciones afectadas contiene una vulnerabilidad de condición de ejecución que podría permitir a atacantes remotos no autenticados eludir las medidas de bloqueo de cuentas predeterminadas.
First Time Mendix mendix
Mendix
CVSS v2 : unknown
v3 : 5.3 		v2 : unknown
v3 : 4.8
CPE cpe:2.3:a:mendix:mendix:*:*:*:*:*:*:*:*

12 Nov 2024, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-11-12 13:15

Updated : 2024-11-15 17:12

NVD link : CVE-2024-50313

Mitre link : CVE-2024-50313

CVE.ORG link : CVE-2024-50313

JSON object : View

Products Affected

mendix

  • mendix
CWE
CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')