CVE-2025-30280

State: Published
Severity: 6.9 Medium
Published: Apr 8, 2025
Updated: Jun 10, 2025
Reserved: Mar 20, 2025

Description

A vulnerability has been identified in Mendix Runtime V10 (All versions < V10.21.0), Mendix Runtime V10.12 (All versions < V10.12.16), Mendix Runtime V10.18 (All versions < V10.18.5), Mendix Runtime V10.6 (All versions < V10.6.22), Mendix Runtime V8 (All versions < V8.18.35), Mendix Runtime V9 (All versions < V9.24.34). Affected applications allow for entity enumeration due to distinguishable responses in certain client actions. This could allow an unauthenticated remote attacker to list all valid entities and attribute names of a Mendix Runtime-based application.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N	siemens
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	siemens

Weaknesses

CWE-204 Observable Response Discrepancy

Affected Products

Product	Versions
Mendix Runtime V10Siemens	before V10.21.0Affected
Mendix Runtime V10.12Siemens	before V10.12.16Affected
Mendix Runtime V10.18Siemens	before V10.18.5Affected
Mendix Runtime V10.6Siemens	before V10.6.22Affected
Mendix Runtime V8Siemens	before V8.18.35Affected
Mendix Runtime V9Siemens	before V9.24.34Affected

References

https://cert-portal.siemens.com/productcert/html/ssa-874353.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.