SSA-851884 V1.2 (Last Update: 2023-08-08): Authentication Bypass Vulnerability in Mendix SAML Module

Risk Summary

<p>The Mendix SAML module insufficiently verifies the SAML assertions. This could allow unauthenticated remote attackers to bypass authentication and get access to the application.</p> <p>Mendix has provided fix releases for the Mendix SAML module and recommends to update to the latest version.</p> <p>Note: For compatibility reasons, fixes for several versions of the Mendix SAML module were introduced in two release steps:</p> <ul> <li><p>The first fix versions address CVE-2023-25957. It removes the vulnerability, except when the recommended, default configuration option <code>'Use Encryption'</code> is disabled.</p></li> <li><p>The second fix versions address CVE-2023-29129, which removes the issue for the non default configuration as well.</p></li> </ul>

CVEs (2)

Remediations

• Refer to Siemens ProductCERT advisory for patch and remediation guidance.

Affected Vendors

Affected Products (1)