Description
A vulnerability has been identified in Mendix Runtime V10 (All versions < V10.21.0), Mendix Runtime V10.12 (All versions < V10.12.16), Mendix Runtime V10.18 (All versions < V10.18.5), Mendix Runtime V10.6 (All versions < V10.6.22), Mendix Runtime V8 (All versions < V8.18.35), Mendix Runtime V9 (All versions < V9.24.34). Affected applications allow for entity enumeration due to distinguishable responses in certain client actions. This could allow an unauthenticated remote attacker to list all valid entities and attribute names of a Mendix Runtime-based application.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Siemens Mendix Runtime V10
Default version status: unknown
0 to < V10.21.0affected
Siemens Mendix Runtime V10.12
Default version status: unknown
0 to < V10.12.16affected
Siemens Mendix Runtime V10.18
Default version status: unknown
0 to < V10.18.5affected
Siemens Mendix Runtime V10.6
Default version status: unknown
0 to < V10.6.22affected
Siemens Mendix Runtime V8
Default version status: unknown
0 to < V8.18.35affected
Siemens Mendix Runtime V9
Default version status: unknown
0 to < V9.24.34affected