CVE-2023-25957 Information

Description

A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All Versions >= 1.16.4 < 1.17.2) Mendix SAML (Mendix 8 compatible) (All versions >= 2.2.0 < 2.2.3) Mendix SAML (Mendix 9 compatible New Track) (All versions >= 3.1.9 < 3.2.5) Mendix SAML (Mendix 9 compatible Upgrade Track) (All versions >= 3.1.9 < 3.2.5). The affected versions of the module insufficiently verifies the SAML assertions. This could allow unauthenticated remote attackers to bypass authentication and get access to the application.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Reference

https://cert-portal.siemens.com/productcert/pdf/ssa-851884.pdf

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

NONE

Base Severity

9.1