CVE-2023-29129: A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.17.3 = V1.16.4 = V2.3.0 = V2.2.0 = V3.3.1 = V3.1.9 = V3.3.0 =…

PriorityP261critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

0.89%

54.8th percentile

A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.17.3 = V1.16.4 = V2.3.0 = V2.2.0 = V3.3.1 = V3.1.9 = V3.3.0 = V3.1.8 = V3.3.1 = V3.3.0 = V3.1.9 = V3.1.8 < V3.2.6). The affected versions of the module insufficiently verify the SAML assertions. This could allow unauthenticated remote attackers to bypass authentication and get access to the application. This CVE entry describes the incomplete fix for CVE-2023-25957 in a specific non default configuration.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
mendix	saml	>= 1.16.4 < 1.18.0	1.18.0
mendix	saml	>= 2.2.0 < 2.4.0	2.4.0
mendix	saml	>= 3.1.8 < 3.6.1	3.6.1

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.