CVE-2024-50313

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-50313
A vulnerability has been identified in Mendix Runtime V10 (All versions < V10.16.0 only if the basic authentication mechanism is used by the application), Mendix Runtime V10.12 (All versions < V10.12.7 only if the basic authentication mechanism is used by the application), Mendix Runtime V10.6 (All versions < V10.6.15 only if the basic authentication mechanism is used by the application), Mendix Runtime V8 (All versions only if the basic authentication mechanism is used by the application), Mendix Runtime V9 (All versions < V9.24.29 only if the basic authentication mechanism is used by the application). The basic authentication implementation of affected applications contains a race condition vulnerability which could allow unauthenticated remote attackers to circumvent default account lockout measures.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://cert-portal.siemens.com/productcert/html/ssa-914892.html Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:mendix:mendix:*:*:*:*:*:*:*:*
cpe:2.3:a:mendix:mendix:*:*:*:*:*:*:*:*
cpe:2.3:a:mendix:mendix:*:*:*:*:*:*:*:*
cpe:2.3:a:mendix:mendix:*:*:*:*:*:*:*:*
History

12 Aug 2025, 12:15

Type Values Removed Values Added
Summary (en) A vulnerability has been identified in Mendix Runtime V10 (All versions < V10.16.0 only if the basic authentication mechanism is used by the application), Mendix Runtime V10.12 (All versions < V10.12.7 only if the basic authentication mechanism is used by the application), Mendix Runtime V10.6 (All versions < V10.6.15 only if the basic authentication mechanism is used by the application), Mendix Runtime V8 (All versions), Mendix Runtime V9 (All versions < V9.24.29 only if the basic authentication mechanism is used by the application). The basic authentication implementation of affected applications contains a race condition vulnerability which could allow unauthenticated remote attackers to circumvent default account lockout measures. (en) A vulnerability has been identified in Mendix Runtime V10 (All versions < V10.16.0 only if the basic authentication mechanism is used by the application), Mendix Runtime V10.12 (All versions < V10.12.7 only if the basic authentication mechanism is used by the application), Mendix Runtime V10.6 (All versions < V10.6.15 only if the basic authentication mechanism is used by the application), Mendix Runtime V8 (All versions only if the basic authentication mechanism is used by the application), Mendix Runtime V9 (All versions < V9.24.29 only if the basic authentication mechanism is used by the application). The basic authentication implementation of affected applications contains a race condition vulnerability which could allow unauthenticated remote attackers to circumvent default account lockout measures.

27 Jan 2025, 18:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 4.8 		v2 : unknown
v3 : 5.3

15 Nov 2024, 17:12

Type Values Removed Values Added
Summary
  • (es) Se ha identificado una vulnerabilidad en Mendix Runtime V10 (todas las versiones anteriores a la V10.16.0, solo si la aplicación utiliza el mecanismo de autenticación básica), Mendix Runtime V10.12 (todas las versiones anteriores a la V10.12.7, solo si la aplicación utiliza el mecanismo de autenticación básica), Mendix Runtime V10.6 (todas las versiones anteriores a la V10.6.15, solo si la aplicación utiliza el mecanismo de autenticación básica), Mendix Runtime V8 (todas las versiones), Mendix Runtime V9 (todas las versiones anteriores a la V9.24.29, solo si la aplicación utiliza el mecanismo de autenticación básica). La implementación de autenticación básica de las aplicaciones afectadas contiene una vulnerabilidad de condición de ejecución que podría permitir a atacantes remotos no autenticados eludir las medidas de bloqueo de cuentas predeterminadas.
First Time Mendix mendix
Mendix
CVSS v2 : unknown
v3 : 5.3 		v2 : unknown
v3 : 4.8
CPE cpe:2.3:a:mendix:mendix:*:*:*:*:*:*:*:*
References () https://cert-portal.siemens.com/productcert/html/ssa-914892.html - () https://cert-portal.siemens.com/productcert/html/ssa-914892.html - Vendor Advisory

12 Nov 2024, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-11-12 13:15

Updated : 2025-08-12 12:15

NVD link : CVE-2024-50313

Mitre link : CVE-2024-50313

CVE.ORG link : CVE-2024-50313

JSON object : View

Products Affected

mendix

  • mendix
CWE
CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')