CVE-2023-25957
published 2023-03-14CVE-2023-25957: A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.16.4 = V2.2.0 = V3.1.9 = V3.1.8 = V3.1.9 = V3.1.8 < V3.2.6). The…
PriorityP350high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.58%
43.4th percentile
A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.16.4 = V2.2.0 = V3.1.9 = V3.1.8 = V3.1.9 = V3.1.8 < V3.2.6). The affected versions of the module insufficiently verify the SAML assertions. This could allow unauthenticated remote attackers to bypass authentication and get access to the application.
For compatibility reasons, fix versions still contain this issue, but only when the recommended, default configuration option `'Use Encryption'` is disabled.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mendix | saml | >= 1.16.4 < 1.18.0 | 1.18.0 |
| mendix | saml | >= 1.16.4 < 1.17.2 | 1.17.2 |
| mendix | saml | >= 2.2.0 < 2.4.0 | 2.4.0 |
| mendix | saml | >= 2.2.0 < 2.2.3 | 2.2.3 |
| mendix | saml | >= 3.1.8 < 3.6.1 | 3.6.1 |
| mendix | saml | >= 3.1.9 < 3.2.5 | 3.2.5 |
| siemens | mendix_saml | — | — |
| siemens | mendix_saml | — | — |
| siemens | mendix_saml | — | — |
| siemens | mendix_saml | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-fwv7-jrxj-q9qv: A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1
ghsa_unreviewed·2023-06-13·CVSS 9.1
CVE-2023-29129 [CRITICAL] CWE-287 GHSA-fwv7-jrxj-q9qv: A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1
A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.17.3 = V1.16.4 = V2.3.0 = V2.2.0 = V3.3.1 = V3.1.9 = V3.3.0 = V3.1.8 < V3.3.0). The affected versions of the module insufficiently verifies the SAML assertions. This could allow unauthenticated remote attackers to bypass authentication and get access to the application.
This CVE entry describes the incomplete fix for CVE-2023-25957 in a specific non default configuration.
GHSA
GHSA-q7cf-mx43-6qm5: A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All Versions >= 1
ghsa_unreviewed·2023-03-14
CVE-2023-25957 [CRITICAL] CWE-287 GHSA-q7cf-mx43-6qm5: A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All Versions >= 1
A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All Versions >= 1.16.4 = 2.2.0 = 3.1.9 = 3.1.9 < 3.2.5). The affected versions of the module insufficiently verifies the SAML assertions. This could allow unauthenticated remote attackers to bypass authentication and get access to the application.
CISA ICS
Siemens Mendix SAML Module
cisa_ics·2023-03-16·CVSS 9.1
[CRITICAL] Siemens Mendix SAML Module
ICS Advisory
##
Siemens Mendix SAML Module
Release DateMarch 16, 2023
Alert CodeICSA-23-075-05
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.1
- ATTENTION: Exploitable remotely / low attack complexity
- Vendor: Siemens
- Equipment: Mendix SAML Module
- Vulnerability: Incorrect Implementation of Authentication Algorithm
## 2. RISK EVALUATION
Successful exploitation of this vulnerability could allow unauthenticated remote attackers to bypass authentication an
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-03-14
Published