CVE-2023-27464

2023-04-1110:15:18

CWE-204

CWE-203

[email protected]

web.nvd.nist.gov

cve-2023-27464

vulnerability

mendix

forgot password

information retrieval

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

18.5%

JSON

A vulnerability has been identified in Mendix Forgot Password (Mendix 7 compatible) (All versions < V3.7.1), Mendix Forgot Password (Mendix 8 compatible) (All versions < V4.1.1), Mendix Forgot Password (Mendix 9 compatible) (All versions < V5.1.1). The affected versions of the module contain an observable response discrepancy issue that could allow an attacker to retrieve sensitive information.

Affected configurations

NVD

Node

mendixforgot_passwordRange<3.7.1

mendixforgot_passwordRange4.0.0–4.1.1

mendixforgot_passwordRange5.0.0–5.1.1

CPENameOperatorVersion
mendix:forgot_passwordmendix forgot passwordlt3.7.1
mendix:forgot_passwordmendix forgot passwordlt4.1.1
mendix:forgot_passwordmendix forgot passwordlt5.1.1

CPE	Name	Operator	Version
mendix:forgot_password	mendix forgot password	lt	3.7.1
mendix:forgot_password	mendix forgot password	lt	4.1.1
mendix:forgot_password	mendix forgot password	lt	5.1.1

CNA Affected

[
  {
    "vendor": "Siemens",
    "product": "Mendix Forgot Password (Mendix 7 compatible)",
    "versions": [
      {
        "version": "All versions < V3.7.1",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "Siemens",
    "product": "Mendix Forgot Password (Mendix 8 compatible)",
    "versions": [
      {
        "version": "All versions < V4.1.1",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "Siemens",
    "product": "Mendix Forgot Password (Mendix 9 compatible)",
    "versions": [
      {
        "version": "All versions < V5.1.1",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  }
]