A vulnerability has been identified in Mendix Runtime V10 (All versions < V10.17.0 only if the basic authentication mechanism is used by the application), Mendix Runtime V10.12 (All versions < V10.12.11 only if the basic authentication mechanism is used by the application), Mendix Runtime V10.6 (All versions < V10.6.19 only if the basic authentication mechanism is used by the application), Mendix Runtime V8 (All versions < V8.18.33 only if the basic authentication mechanism is used by the application), Mendix Runtime V9 (All versions < V9.24.31 only if the basic authentication mechanism is used by the application). The authentication mechanism of affected applications contains an observable response discrepancy vulnerability when validating usernames. This could allow unauthenticated remote attackers to distinguish between valid and invalid usernames.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Mendix Runtime V10
Vendor
Siemens
Product
Mendix Runtime V10
Platforms
Unknown
Default status
unknown
Mendix Runtime V10 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
custom
V10.17.0
Unavailable
None listed
Mendix Runtime V10.12
Vendor
Siemens
Product
Mendix Runtime V10.12
Platforms
Unknown
Default status
unknown
Mendix Runtime V10.12 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
custom
V10.12.11
Unavailable
None listed
Mendix Runtime V10.6
Vendor
Siemens
Product
Mendix Runtime V10.6
Platforms
Unknown
Default status
unknown
Mendix Runtime V10.6 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
custom
V10.6.19
Unavailable
None listed
Mendix Runtime V8
Vendor
Siemens
Product
Mendix Runtime V8
Platforms
Unknown
Default status
unknown
Mendix Runtime V8 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
custom
V8.18.33
Unavailable
None listed
Mendix Runtime V9
Vendor
Siemens
Product
Mendix Runtime V9
Platforms
Unknown
Default status
unknown
Mendix Runtime V9 · Scoped product and version facts