Entity Enumeration Vulnerability in Mendix Runtime
CVE-2025-30280

6.9MEDIUM

Key Information:

Vendor
Siemens
Status
Mendix Runtime V10
Mendix Runtime V10.12
Mendix Runtime V10.18
Mendix Runtime V10.6
Vendor
CVE Published:
8 April 2025

Summary

A vulnerability has been identified in multiple versions of Mendix Runtime, where certain client actions allow for entity enumeration due to distinguishable responses. This enables an unauthenticated remote attacker to potentially disclose sensitive information by listing all valid entities and their associated attribute names within a Mendix Runtime-based application.

Affected Version(s)

Mendix Runtime V10 0

Mendix Runtime V10.12 0

Mendix Runtime V10.18 0

References

https://cert-portal.siemens.com/productcert/html/ssa-8743...

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.