Siemens Mendix Encryption Module
The Mendix Encryption module versions V10.0.0 and V10.0.1 define a specific hard-coded default value for the EncryptionKey constant, which is used in projects where no individual EncryptionKey was specified. This could allow to an attacker to decrypt any encrypted project data, as the default encryption key can be considered compromised. Siemens has released a new version for Mendix Encryption and recommends to update to the latest version.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-39888US | — | — | ||
A vulnerability has been identified in Mendix Encryption (All versions >= V10.0.0 < V10.0.2). Affected versions of the module define a specific hard-coded default value for the Enc… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-998949: Hard-coded Default Encryption Key in Mendix Encryption Module V10.0.0 and V10.0.1 - CSAF Versionself
- SSA-998949: Hard-coded Default Encryption Key in Mendix Encryption Module V10.0.0 and V10.0.1 - HTML Versionself
- SSA-998949: Hard-coded Default Encryption Key in Mendix Encryption Module V10.0.0 and V10.0.1 - PDF Versionself
- SSA-998949: Hard-coded Default Encryption Key in Mendix Encryption Module V10.0.0 and V10.0.1 - TXT Versionself
- ICS Advisory ICSA-24-193-08 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-24-193-08 - Web Versionself
- Recommended Practicesexternal
Behebungen (1)
- BehobenMendix Encryption
Update to V10.0.2 or later version
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan