CVE-2023-23835
Vulnerability from cvelistv5
Published
2023-02-14 10:36
Modified
2024-08-02 10:42
Severity ?
EPSS score ?
Summary
A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.34), Mendix Applications using Mendix 8 (All versions < V8.18.23), Mendix Applications using Mendix 9 (All versions < V9.22.0), Mendix Applications using Mendix 9 (V9.12) (All versions < V9.12.10), Mendix Applications using Mendix 9 (V9.18) (All versions < V9.18.4), Mendix Applications using Mendix 9 (V9.6) (All versions < V9.6.15). Some of the Mendix runtime API’s allow attackers to bypass XPath constraints and retrieve information using XPath queries that trigger errors.
References
▼ | URL | Tags | |
---|---|---|---|
productcert@siemens.com | https://cert-portal.siemens.com/productcert/pdf/ssa-252808.pdf | Release Notes, Third Party Advisory |
Impacted products
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T10:42:27.044Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-252808.pdf" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unknown", "product": "Mendix Applications using Mendix 7", "vendor": "Siemens", "versions": [ { "status": "affected", "version": "All versions \u003c V7.23.34" } ] }, { "defaultStatus": "unknown", "product": "Mendix Applications using Mendix 8", "vendor": "Siemens", "versions": [ { "status": "affected", "version": "All versions \u003c V8.18.23" } ] }, { "defaultStatus": "unknown", "product": "Mendix Applications using Mendix 9", "vendor": "Siemens", "versions": [ { "status": "affected", "version": "All versions \u003c V9.22.0" } ] }, { "defaultStatus": "unknown", "product": "Mendix Applications using Mendix 9 (V9.12)", "vendor": "Siemens", "versions": [ { "status": "affected", "version": "All versions \u003c V9.12.10" } ] }, { "defaultStatus": "unknown", "product": "Mendix Applications using Mendix 9 (V9.18)", "vendor": "Siemens", "versions": [ { "status": "affected", "version": "All versions \u003c V9.18.4" } ] }, { "defaultStatus": "unknown", "product": "Mendix Applications using Mendix 9 (V9.6)", "vendor": "Siemens", "versions": [ { "status": "affected", "version": "All versions \u003c V9.6.15" } ] } ], "descriptions": [ { "lang": "en", "value": "A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions \u003c V7.23.34), Mendix Applications using Mendix 8 (All versions \u003c V8.18.23), Mendix Applications using Mendix 9 (All versions \u003c V9.22.0), Mendix Applications using Mendix 9 (V9.12) (All versions \u003c V9.12.10), Mendix Applications using Mendix 9 (V9.18) (All versions \u003c V9.18.4), Mendix Applications using Mendix 9 (V9.6) (All versions \u003c V9.6.15). Some of the Mendix runtime API\u2019s allow attackers to bypass XPath constraints and retrieve information using XPath queries that trigger errors." } ], "metrics": [ { "cvssV3_1": { "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C", "version": "3.1" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-284", "description": "CWE-284: Improper Access Control", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2023-02-15T09:24:58.910Z", "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "shortName": "siemens" }, "references": [ { "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-252808.pdf" } ] } }, "cveMetadata": { "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "assignerShortName": "siemens", "cveId": "CVE-2023-23835", "datePublished": "2023-02-14T10:36:23.615Z", "dateReserved": "2023-01-18T10:28:31.589Z", "dateUpdated": "2024-08-02T10:42:27.044Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2023-23835\",\"sourceIdentifier\":\"productcert@siemens.com\",\"published\":\"2023-02-14T11:15:14.687\",\"lastModified\":\"2023-02-22T15:44:23.027\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions \u003c V7.23.34), Mendix Applications using Mendix 8 (All versions \u003c V8.18.23), Mendix Applications using Mendix 9 (All versions \u003c V9.22.0), Mendix Applications using Mendix 9 (V9.12) (All versions \u003c V9.12.10), Mendix Applications using Mendix 9 (V9.18) (All versions \u003c V9.18.4), Mendix Applications using Mendix 9 (V9.6) (All versions \u003c V9.6.15). Some of the Mendix runtime API\u2019s allow attackers to bypass XPath constraints and retrieve information using XPath queries that trigger errors.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"productcert@siemens.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":5.9,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":2.2,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"productcert@siemens.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-284\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mendix:mendix:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.0.2\",\"versionEndExcluding\":\"7.23.34\",\"matchCriteriaId\":\"43E9E16C-936B-47D4-B5C1-30EAF7F6B8AE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mendix:mendix:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.0\",\"versionEndExcluding\":\"8.18.23\",\"matchCriteriaId\":\"7A1ED592-BD7C-43FB-812E-15F579F8F40E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mendix:mendix:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"9.0.0\",\"versionEndExcluding\":\"9.6.15\",\"matchCriteriaId\":\"B3CFFFE6-F0CD-4C06-B3D7-44F3FA84B346\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mendix:mendix:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"9.7.0\",\"versionEndExcluding\":\"9.12.10\",\"matchCriteriaId\":\"DFBB912C-5B70-436C-A615-717C6C90E25C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mendix:mendix:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"9.18.0\",\"versionEndExcluding\":\"9.18.4\",\"matchCriteriaId\":\"7AC5D595-F345-4533-BF6D-451CAFF17E13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mendix:mendix:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"9.19.0\",\"versionEndExcluding\":\"9.22.0\",\"matchCriteriaId\":\"9B9D7FEC-9D09-4CFD-AD46-880655E27898\"}]}]}],\"references\":[{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-252808.pdf\",\"source\":\"productcert@siemens.com\",\"tags\":[\"Release Notes\",\"Third Party Advisory\"]}]}}" } }
Loading...
Loading...
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.