CVE-2023-49069

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in Mendix Runtime V10 (All versions < V10.17.0 only if the basic authentication mechanism is used by the application), Mendix Runtime V10.12 (All versions < V10.12.11 only if the basic authentication mechanism is used by the application), Mendix Runtime V10.6 (All versions < V10.6.19 only if the basic authentication mechanism is used by the application), Mendix Runtime V8 (All versions < V8.18.33 only if the basic authentication mechanism is used by the application), Mendix Runtime V9 (All versions < V9.24.31 only if the basic authentication mechanism is used by the application). The authentication mechanism of affected applications contains an observable response discrepancy vulnerability when validating usernames. This could allow unauthenticated remote attackers to distinguish between valid and invalid usernames.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-204

Affected software

Vendor	Product	Versions
Siemens	Mendix Runtime V10	< V10.17.0
Siemens	Mendix Runtime V10.12	< V10.12.11
Siemens	Mendix Runtime V10.6	< V10.6.19
Siemens	Mendix Runtime V8	< V8.18.33
Siemens	Mendix Runtime V9	< V9.24.31
siemens	mendix	>= 8.0, < 9.24.26; >= 10.0, < 10.6.12; >= 10.7, < 10.12.2; >= 10.13, < 10.14.0

References

https://cert-portal.siemens.com/productcert/html/ssa-097435.html

Timeline

Published: Sep 10, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2023

CVE-2023-49074.3Inappropriate implementation in Intents in Google Chrome on Android prior to 117.0.5938.62 allowed a remote attacker to obfuscate security U CVE-2023-490709.8Pre-auth RCE in Apache Ofbiz 18.12.09. It's due to XML-RPC no longer maintained still present. This issue affects Apache OFBiz: before 18.1 CVE-2023-490737.2A stack-based buffer overflow vulnerability exists in the boa formFilter functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially cr CVE-2023-490747.5A denial of service vulnerability exists in the TDDP functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.CVE-2023-490757.2The Admin Classic Bundle provides a Backend UI for Pimcore. `AdminBundle\Security\PimcoreUserTwoFactorCondition` introduced in v11 disable t CVE-2023-490766.5Customer-data-framework allows management of customer data within Pimcore. There are no tokens or headers to prevent CSRF attacks from occur CVE-2023-490776.1Mailcow: dockerized is an open source groupware/email suite based on docker. A Cross-Site Scripting (XSS) vulnerability has been identified CVE-2023-490786.1raptor-web is a CMS for game server communities that can be used to host information and keep track of players. In version 0.4.4 of raptor-w CVE-2023-490797.5Misskey is an open source, decentralized social media platform. Misskey's missing signature validation allows arbitrary users to impersonate CVE-2023-49084.3Inappropriate implementation in Picture in Picture in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to spoof security UI vi CVE-2023-490804.3The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter noteboo CVE-2023-490815.3aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modi