Siemens Mendix Runtime

🗓️ 10 Sep 2024 00:00:00Reported by Industrial Control Systems Cyber Emergency Response TeamType

ics🔗 www.cisa.gov👁 13 Views

Siemens Mendix Runtime vulnerability allows unauthenticated remote attackers to distinguish between valid and invalid usernames. Apply specific updates and alternative authentication mechanisms to mitigate the risk

Reporter	Title	Published	Views	Family All 11
bdu_fstec	The vulnerability of the Basic Authentication mechanism in the Mendix Runtime environment allows a perpetrator to gain unauthorized access to protected information.	13 Nov 202400:00	–	bdu_fstec
cnnvd	Siemens Mendix 安全漏洞	10 Sep 202400:00	–	cnnvd
cnvd	Siemens Mendix Runtime Information Disclosure Vulnerability	12 Sep 202400:00	–	cnvd
cve	CVE-2023-49069	10 Sep 202409:36	–	cve
cvelist	CVE-2023-49069	10 Sep 202409:36	–	cvelist
euvd	EUVD-2023-53091	3 Oct 202520:07	–	euvd
ncsc	Vulnerabilities fixed in Siemens products	10 Sep 202418:20	–	ncsc
nvd	CVE-2023-49069	10 Sep 202410:15	–	nvd
ptsecurity	PT-2023-9659 · Mendix · Mendix Runtime	21 Nov 202300:00	–	ptsecurity
redhatcve	CVE-2023-49069	9 Jan 202609:29	–	redhatcve

Source	Link
cert-portal	www.cert-portal.siemens.com/productcert/csaf/ssa-097435.json
cert-portal	www.cert-portal.siemens.com/productcert/html/ssa-097435.html
raw	www.raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-256-05.json
cisa	www.cisa.gov/news-events/ics-advisories/icsa-24-256-05
cisa	www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
cisa	www.cisa.gov/resources-tools/resources/ics-recommended-practices
cisa	www.cisa.gov/topics/industrial-control-systems
us-cert	www.us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
cisa	www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
cisa	www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B

10 Sep 2024 00:00Current

7.3High risk

Vulners AI Score7.3

CVSS 3.15.3

CVSS 46.9

EPSS0.0044

SSVC