Siemens Mendix SAML Module
The Mendix SAML module insufficiently verifies the SAML assertions. This could allow unauthenticated remote attackers to bypass authentication and get access to the application. Mendix has provided fix releases for the Mendix SAML module and recommends to update to the latest version. Note: For compatibility reasons, fixes for several versions of the Mendix SAML module were introduced in two release steps: - The first fix versions address CVE-2023-25957. It removes the vulnerability, except when the recommended, default configuration option 'Use Encryption' is disabled. - The second fix versions address CVE-2023-29129, which removes the issue for the non default configuration as well.
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-29129US | critical9.8 | — | ||
A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.17.3 < V1.18.0), Mendix SAML (Mendix 7 compatible) (All versions >= V1.16.4 < V1.17.3),… | ||||
| CVE-2023-25957US | high7.5 | — | ||
A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.16.4 < V1.17.3), Mendix SAML (Mendix 8 compatible) (All versions >= V2.2.0 < V2.3.0), M… | ||||
references
External citations — patches, advisories, analysis.
- SSA-851884: Authentication Bypass Vulnerability in Mendix SAML Module - CSAF Versionself
- SSA-851884: Authentication Bypass Vulnerability in Mendix SAML Module - HTML Versionself
- SSA-851884: Authentication Bypass Vulnerability in Mendix SAML Module - PDF Versionself
- SSA-851884: Authentication Bypass Vulnerability in Mendix SAML Module - TXT Versionself
- ICS Advisory ICSA-23-075-05 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-23-075-05 - Web Versionself
- Recommended Practicesexternal
remediations (14)
- FixedMendix SAML (Mendix 7 compatible)
Update to V1.17.3 or later version
https://marketplace.mendix.com/link/component/1174 - FixedMendix SAML (Mendix 7 compatible)
Update to V1.17.3 or later version
https://marketplace.mendix.com/link/component/1174 - FixedMendix SAML (Mendix 8 compatible)
Update to V2.3.0 or later version
https://marketplace.mendix.com/link/component/1174 - FixedMendix SAML (Mendix 8 compatible)
Update to V2.3.0 or later version
https://marketplace.mendix.com/link/component/1174 - FixedMendix SAML (Mendix 9 latest compatible, New Track)
Update to V3.3.1 or later version
https://marketplace.mendix.com/link/component/1174 - FixedMendix SAML (Mendix 9 latest compatible, New Track)
Update to V3.3.1 or later version
https://marketplace.mendix.com/link/component/1174 - FixedMendix SAML (Mendix 9 latest compatible, Upgrade Track)
Update to V3.3.0 or later version
https://marketplace.mendix.com/link/component/1174 - FixedMendix SAML (Mendix 9 latest compatible, Upgrade Track)
Update to V3.3.0 or later version
https://marketplace.mendix.com/link/component/1174 - FixedMendix SAML (Mendix 9.12/9.18 compatible, New Track)
Update to V3.3.15 or later version
https://marketplace.mendix.com/link/component/1174 - FixedMendix SAML (Mendix 9.12/9.18 compatible, Upgrade Track)
Update to V3.3.14 or later version
https://marketplace.mendix.com/link/component/1174 - FixedMendix SAML (Mendix 9.6 compatible, New Track)
Update to V3.2.7 or later version
https://marketplace.mendix.com/link/component/1174 - FixedMendix SAML (Mendix 9.6 compatible, New Track)
Update to V3.2.7 or later version
https://marketplace.mendix.com/link/component/1174 - FixedMendix SAML (Mendix 9.6 compatible, Upgrade Track)
Update to V3.2.6 or later version
https://marketplace.mendix.com/link/component/1174 - FixedMendix SAML (Mendix 9.6 compatible, Upgrade Track)
Update to V3.2.6 or later version
https://marketplace.mendix.com/link/component/1174
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan