CVE-2023-23835
First published: Tue Feb 14 2023(Updated: )
A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.34), Mendix Applications using Mendix 8 (All versions < V8.18.23), Mendix Applications using Mendix 9 (All versions < V9.22.0), Mendix Applications using Mendix 9 (V9.12) (All versions < V9.12.10), Mendix Applications using Mendix 9 (V9.18) (All versions < V9.18.4), Mendix Applications using Mendix 9 (V9.6) (All versions < V9.6.15). Some of the Mendix runtime API’s allow attackers to bypass XPath constraints and retrieve information using XPath queries that trigger errors.
Credit: productcert@siemens.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mendix | >=7.0.2<7.23.34 | |
| Mendix | >=8.0.0<8.18.23 | |
| Mendix | >=9.0.0<9.6.15 | |
| Mendix | >=9.7.0<9.12.10 | |
| Mendix | >=9.18.0<9.18.4 | |
| Mendix | >=9.19.0<9.22.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the vulnerability ID of this Mendix application vulnerability?
The vulnerability ID is CVE-2023-23835.
What versions of Mendix are affected by this vulnerability?
Mendix 7 versions < V7.23.34, Mendix 8 versions < V8.18.23, Mendix 9 versions < V9.22.0, Mendix 9 (V9.12) versions < V9.12.10.
What is the severity of CVE-2023-23835?
The severity of CVE-2023-23835 is high (7.5).
How can I fix the vulnerability in my Mendix application?
To fix the vulnerability, update your Mendix application to the latest version (V7.23.34 for Mendix 7, V8.18.23 for Mendix 8, V9.22.0 for Mendix 9).
Where can I find more information about CVE-2023-23835?
More information about CVE-2023-23835 can be found at the following reference: [https://cert-portal.siemens.com/productcert/pdf/ssa-252808.pdf](https://cert-portal.siemens.com/productcert/pdf/ssa-252808.pdf).
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/references
- agent/author
- agent/last-modified-date
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/mendix
- canonical/mendix
- version/mendix/7.0.2
- version/mendix/8.0.0
- version/mendix/9.0.0
- version/mendix/9.7.0
- version/mendix/9.18.0
- version/mendix/9.19.0