CVE-2023-45794
- State
- Published
- Severity
- 6.8 Medium
- Published
- Nov 14, 2023
- Updated
- Dec 16, 2025
- Reserved
- Oct 12, 2023
Description
A vulnerability has been identified in Mendix Applications using Mendix 10 (All versions < V10.4.0), Mendix Applications using Mendix 7 (All versions < V7.23.37), Mendix Applications using Mendix 8 (All versions < V8.18.27), Mendix Applications using Mendix 9 (All versions < V9.24.10). A capture-replay flaw in the platform could have an impact to apps built with the platform, if certain preconditions are met that depend on the app's model and access control design.
This could allow authenticated attackers to access or modify objects without proper authorization, or escalate privileges in the context of the vulnerable app.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.8 Medium | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C | siemens |
Weaknesses
- CWE-294 Authentication Bypass by Capture-replay
Affected Products
| Product | Versions |
|---|---|
Mendix Applications using Mendix 10Siemens |
|
Mendix Applications using Mendix 7Siemens |
|
Mendix Applications using Mendix 8Siemens |
|
Mendix Applications using Mendix 9Siemens |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.