User Enumeration Vulnerability in Mendix Forgot Password Modules

CVE-2023-43623

Summary

A security issue has been discovered in the Mendix Forgot Password modules across multiple compatible versions, where applications allow for user enumeration due to distinguishable responses. This vulnerability can be exploited by unauthenticated remote attackers, enabling them to ascertain the validity of a username. Once valid users are identified, the attackers can leverage this information to execute brute force attacks, further compromising user accounts and potentially gaining unauthorized access.

References