SSA-295483: User Enumeration Vulnerability in Mendix Forgot Password Module
view advisory published 2023-10-10
The Mendix Forgot Password module contains a user enumeration vulnerability that could allow an attacker to retrieve valid users. Siemens has released updates for the affected products and recommends to update to the latest versions.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-43623US | — | — | ||
A vulnerability has been identified in Mendix Forgot Password (Mendix 10 compatible) (All versions < V5.4.0), Mendix Forgot Password (Mendix 7 compatible) (All versions < V3.7.3),… | ||||
02
references
External citations — patches, advisories, analysis.
- SSA-295483: User Enumeration Vulnerability in Mendix Forgot Password Module - CSAF Versionself
- SSA-295483: User Enumeration Vulnerability in Mendix Forgot Password Module - HTML Versionself
- SSA-295483: User Enumeration Vulnerability in Mendix Forgot Password Module - PDF Versionself
- SSA-295483: User Enumeration Vulnerability in Mendix Forgot Password Module - TXT Versionself
03
remediations (4)
- FixedMendix Forgot Password (Mendix 10 compatible)
Update to V5.4.0 or later version
https://marketplace.mendix.com/link/component/1296 - FixedMendix Forgot Password (Mendix 7 compatible)
Update to V3.7.3 or later version
https://marketplace.mendix.com/link/component/1296 - FixedMendix Forgot Password (Mendix 8 compatible)
Update to V4.1.3 or later version
https://marketplace.mendix.com/link/component/1296 - FixedMendix Forgot Password (Mendix 9 compatible)
Update to V5.4.0 or later version
https://marketplace.mendix.com/link/component/1296
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan