Race Condition Vulnerability Affects Mendix Runtime Versions
CVE-2024-50313

6.9MEDIUM

Key Information:

Vendor

Siemens
Status
Mendix Runtime V10
Mendix Runtime V10.12
Mendix Runtime V10.6
Mendix Runtime V8
Vendor
CVE Published:
12 November 2024

What is CVE-2024-50313?

A vulnerability has been identified in Mendix Runtime V10 (All versions < V10.16.0 only if the basic authentication mechanism is used by the application), Mendix Runtime V10.12 (All versions < V10.12.7 only if the basic authentication mechanism is used by the application), Mendix Runtime V10.6 (All versions < V10.6.15 only if the basic authentication mechanism is used by the application), Mendix Runtime V8 (All versions only if the basic authentication mechanism is used by the application), Mendix Runtime V9 (All versions < V9.24.29 only if the basic authentication mechanism is used by the application). The basic authentication implementation of affected applications contains a race condition vulnerability which could allow unauthenticated remote attackers to circumvent default account lockout measures.

Affected Version(s)

Mendix Runtime V10 0

Mendix Runtime V10.12 0

Mendix Runtime V10.6 0

References

https://cert-portal.siemens.com/productcert/html/ssa-9148...

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.