CVE-2023-45794 - Vulnerability Details - OpenCVE

A vulnerability has been identified in Mendix Applications using Mendix 10 (All versions < V10.4.0), Mendix Applications using Mendix 7 (All versions < V7.23.37), Mendix Applications using Mendix 8 (All versions < V8.18.27), Mendix Applications using Mendix 9 (All versions < V9.24.10). A capture-replay flaw in the platform could have an impact to apps built with the platform, if certain preconditions are met that depend on the app's model and access control design. This could allow authenticated attackers to access or modify objects without proper authorization, or escalate privileges in the context of the vulnerable app.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation None

Automatable No

Technical Impact Total

Vendors	Products
Siemens	Mendix

Configuration 1 [-]

OR	cpe:2.3:a:siemens:mendix::::::::
	cpe:2.3:a:siemens:mendix::::::::
	cpe:2.3:a:siemens:mendix::::::::
	cpe:2.3:a:siemens:mendix::::::::

No data.

References

Link	Providers
https://cert-portal.siemens.com/productcert/pdf/ssa-084182.pdf

History

Wed, 08 Jan 2025 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'No', 'Exploitation': 'None', 'Technical Impact': 'Total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: siemens

Published: 2023-11-14T11:04:16.602Z

Updated: 2025-01-08T16:39:58.374Z

Reserved: 2023-10-12T17:15:59.195Z

Link: CVE-2023-45794

Vulnrichment

Updated: 2024-08-02T20:29:32.353Z

NVD

Status : Modified

Published: 2023-11-14T11:15:13.970

Modified: 2024-11-21T08:27:22.200

Link: CVE-2023-45794

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-45794", "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "state": "PUBLISHED", "assignerShortName": "siemens", "dateReserved": "2023-10-12T17:15:59.195Z", "datePublished": "2023-11-14T11:04:16.602Z", "dateUpdated": "2025-01-08T16:39:58.374Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "shortName": "siemens", "dateUpdated": "2023-11-14T11:04:16.602Z"}, "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in Mendix Applications using Mendix 10 (All versions < V10.4.0), Mendix Applications using Mendix 7 (All versions < V7.23.37), Mendix Applications using Mendix 8 (All versions < V8.18.27), Mendix Applications using Mendix 9 (All versions < V9.24.10). A capture-replay flaw in the platform could have an impact to apps built with the platform, if certain preconditions are met that depend on the app's model and access control design.\r\n\r\nThis could allow authenticated attackers to access or modify objects without proper authorization, or escalate privileges in the context of the vulnerable app."}], "affected": [{"vendor": "Siemens", "product": "Mendix Applications using Mendix 10", "versions": [{"version": "All versions < V10.4.0", "status": "affected"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "Mendix Applications using Mendix 7", "versions": [{"version": "All versions < V7.23.37", "status": "affected"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "Mendix Applications using Mendix 8", "versions": [{"version": "All versions < V8.18.27", "status": "affected"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "Mendix Applications using Mendix 9", "versions": [{"version": "All versions < V9.24.10", "status": "affected"}], "defaultStatus": "unknown"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C", "baseScore": 6.8, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-294", "description": "CWE-294: Authentication Bypass by Capture-replay", "type": "CWE"}]}], "references": [{"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-084182.pdf"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T20:29:32.353Z"}, "title": "CVE Program Container", "references": [{"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-084182.pdf", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2023-11-18T05:00:40.318879Z", "id": "CVE-2023-45794", "options": [{"Exploitation": "None"}, {"Automatable": "No"}, {"Technical Impact": "Total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-08T16:39:58.374Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-084182.pdf", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T20:29:32.353Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-45794", "role": "CISA Coordinator", "options": [{"Exploitation": "None"}, {"Automatable": "No"}, {"Technical Impact": "Total"}], "version": "2.0.3", "timestamp": "2023-11-18T05:00:40.318879Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-08T16:39:53.804Z"}}], "cna": {"metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C"}}], "affected": [{"vendor": "Siemens", "product": "Mendix Applications using Mendix 10", "versions": [{"status": "affected", "version": "All versions < V10.4.0"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "Mendix Applications using Mendix 7", "versions": [{"status": "affected", "version": "All versions < V7.23.37"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "Mendix Applications using Mendix 8", "versions": [{"status": "affected", "version": "All versions < V8.18.27"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "Mendix Applications using Mendix 9", "versions": [{"status": "affected", "version": "All versions < V9.24.10"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-084182.pdf"}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in Mendix Applications using Mendix 10 (All versions < V10.4.0), Mendix Applications using Mendix 7 (All versions < V7.23.37), Mendix Applications using Mendix 8 (All versions < V8.18.27), Mendix Applications using Mendix 9 (All versions < V9.24.10). A capture-replay flaw in the platform could have an impact to apps built with the platform, if certain preconditions are met that depend on the app's model and access control design.\r\n\r\nThis could allow authenticated attackers to access or modify objects without proper authorization, or escalate privileges in the context of the vulnerable app."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-294", "description": "CWE-294: Authentication Bypass by Capture-replay"}]}], "providerMetadata": {"orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "shortName": "siemens", "dateUpdated": "2023-11-14T11:04:16.602Z"}}}, "cveMetadata": {"cveId": "CVE-2023-45794", "state": "PUBLISHED", "dateUpdated": "2025-01-08T16:39:58.374Z", "dateReserved": "2023-10-12T17:15:59.195Z", "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "datePublished": "2023-11-14T11:04:16.602Z", "assignerShortName": "siemens"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:siemens:mendix:*:*:*:*:*:*:*:*", "matchCriteriaId": "9349FE43-89A4-4C6D-8DB4-CB7F001C4997", "versionEndExcluding": "7.23.37", "versionStartIncluding": "7.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:siemens:mendix:*:*:*:*:*:*:*:*", "matchCriteriaId": "1310418B-0106-4E1E-A4A7-1FF7FF2EA297", "versionEndExcluding": "8.18.27", "versionStartIncluding": "8.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:siemens:mendix:*:*:*:*:*:*:*:*", "matchCriteriaId": "3E92B744-3CC1-4980-8DA0-781C9B4B18B9", "versionEndExcluding": "9.24.10", "versionStartIncluding": "9.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:siemens:mendix:*:*:*:*:*:*:*:*", "matchCriteriaId": "AB61E750-0A04-44E0-B0AE-4451D4ACA46E", "versionEndExcluding": "10.4.0", "versionStartIncluding": "10.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in Mendix Applications using Mendix 10 (All versions < V10.4.0), Mendix Applications using Mendix 7 (All versions < V7.23.37), Mendix Applications using Mendix 8 (All versions < V8.18.27), Mendix Applications using Mendix 9 (All versions < V9.24.10). A capture-replay flaw in the platform could have an impact to apps built with the platform, if certain preconditions are met that depend on the app's model and access control design.\r\n\r\nThis could allow authenticated attackers to access or modify objects without proper authorization, or escalate privileges in the context of the vulnerable app."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad en aplicaciones Mendix que usan:\nMendix 10 (todas las versiones < V10.4.0),\nMendix 7 (todas las versiones < V7.23.37),\nMendix 8 (todas las versiones < V8.18.27),\nMendix 9 (todas las versiones "}], "id": "CVE-2023-45794", "lastModified": "2024-11-21T08:27:22.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.2, "source": "productcert@siemens.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-11-14T11:15:13.970", "references": [{"source": "productcert@siemens.com", "tags": ["Vendor Advisory"], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-084182.pdf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-084182.pdf"}], "sourceIdentifier": "productcert@siemens.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-294"}], "source": "productcert@siemens.com", "type": "Secondary"}]}