SSA-699404: Observable Response Discrepancy in Mendix Forgot Password Module
view advisory published 2023-04-11
The Mendix Forgot Password module contains an observable response discrepancy issue that could allow an attacker to retrieve sensitive information. Siemens has released updates for the affected products and recommends to update to the latest versions.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-27464US | — | — | ||
A vulnerability has been identified in Mendix Forgot Password (Mendix 7 compatible) (All versions < V3.7.1), Mendix Forgot Password (Mendix 8 compatible) (All versions < V4.1.1), M… | ||||
02
references
External citations — patches, advisories, analysis.
- SSA-699404: Observable Response Discrepancy in Mendix Forgot Password Module - CSAF Versionself
- SSA-699404: Observable Response Discrepancy in Mendix Forgot Password Module - HTML Versionself
- SSA-699404: Observable Response Discrepancy in Mendix Forgot Password Module - PDF Versionself
- SSA-699404: Observable Response Discrepancy in Mendix Forgot Password Module - TXT Versionself
03
remediations (3)
- FixedMendix Forgot Password (Mendix 7 compatible)
Update to V3.7.1 or later version
https://marketplace.mendix.com/link/component/1296 - FixedMendix Forgot Password (Mendix 8 compatible)
Update to V4.1.1 or later version
https://marketplace.mendix.com/link/component/1296 - FixedMendix Forgot Password (Mendix 9 compatible)
Update to V5.1.1 or later version
https://marketplace.mendix.com/link/component/1296
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan