SSA-851884: Authentication Bypass Vulnerability in Mendix SAML Module
The Mendix SAML module insufficiently verifies the SAML assertions. This could allow unauthenticated remote attackers to bypass authentication and get access to the application. Mendix has provided fix releases for the Mendix SAML module and recommends to update to the latest version. Note: For compatibility reasons, fixes for several versions of the Mendix SAML module were introduced in two release steps: - The first fix versions address CVE-2023-25957. It removes the vulnerability, except when the recommended, default configuration option 'Use Encryption' is disabled. - The second fix versions address CVE-2023-29129, which removes the issue for the non default configuration as well.
beschreibt (2)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-29129US | critical9.8 | — | ||
A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.17.3 < V1.18.0), Mendix SAML (Mendix 7 compatible) (All versions >= V1.16.4 < V1.17.3),… | ||||
| CVE-2023-25957US | high7.5 | — | ||
A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.16.4 < V1.17.3), Mendix SAML (Mendix 8 compatible) (All versions >= V2.2.0 < V2.3.0), M… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-851884: Authentication Bypass Vulnerability in Mendix SAML Module - CSAF Versionself
- SSA-851884: Authentication Bypass Vulnerability in Mendix SAML Module - HTML Versionself
- SSA-851884: Authentication Bypass Vulnerability in Mendix SAML Module - PDF Versionself
- SSA-851884: Authentication Bypass Vulnerability in Mendix SAML Module - TXT Versionself
Behebungen (14)
- BehobenMendix SAML (Mendix 7 compatible)
Update to V1.17.3 or later version
https://marketplace.mendix.com/link/component/1174 - BehobenMendix SAML (Mendix 7 compatible)
Update to V1.17.3 or later version
https://marketplace.mendix.com/link/component/1174 - BehobenMendix SAML (Mendix 8 compatible)
Update to V2.3.0 or later version
https://marketplace.mendix.com/link/component/1174 - BehobenMendix SAML (Mendix 8 compatible)
Update to V2.3.0 or later version
https://marketplace.mendix.com/link/component/1174 - BehobenMendix SAML (Mendix 9 latest compatible, New Track)
Update to V3.3.1 or later version
https://marketplace.mendix.com/link/component/1174 - BehobenMendix SAML (Mendix 9 latest compatible, New Track)
Update to V3.3.1 or later version
https://marketplace.mendix.com/link/component/1174 - BehobenMendix SAML (Mendix 9 latest compatible, Upgrade Track)
Update to V3.3.0 or later version
https://marketplace.mendix.com/link/component/1174 - BehobenMendix SAML (Mendix 9 latest compatible, Upgrade Track)
Update to V3.3.0 or later version
https://marketplace.mendix.com/link/component/1174 - BehobenMendix SAML (Mendix 9.12/9.18 compatible, New Track)
Update to V3.3.15 or later version
https://marketplace.mendix.com/link/component/1174 - BehobenMendix SAML (Mendix 9.12/9.18 compatible, Upgrade Track)
Update to V3.3.14 or later version
https://marketplace.mendix.com/link/component/1174 - BehobenMendix SAML (Mendix 9.6 compatible, New Track)
Update to V3.2.7 or later version
https://marketplace.mendix.com/link/component/1174 - BehobenMendix SAML (Mendix 9.6 compatible, New Track)
Update to V3.2.7 or later version
https://marketplace.mendix.com/link/component/1174 - BehobenMendix SAML (Mendix 9.6 compatible, Upgrade Track)
Update to V3.2.6 or later version
https://marketplace.mendix.com/link/component/1174 - BehobenMendix SAML (Mendix 9.6 compatible, Upgrade Track)
Update to V3.2.6 or later version
https://marketplace.mendix.com/link/component/1174
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan