What is the severity of CVE-2025-30280?

CVE-2025-30280 is a high-severity vulnerability affecting multiple versions of Mendix Runtime.

How do I fix CVE-2025-30280?

To fix CVE-2025-30280, upgrade to Mendix Runtime version 10.21.0 or later for the affected 10.x versions, or update to the latest patch for 8.x and 9.x versions.

Which versions of Mendix Runtime are affected by CVE-2025-30280?

CVE-2025-30280 affects all versions of Mendix Runtime prior to 10.21.0, as well as versions 10.12, 10.18, 10.6, 8, and all versions prior to 9.24.34.

What types of vulnerabilities are associated with CVE-2025-30280?

CVE-2025-30280 is associated with vulnerabilities that could lead to unauthorized access or data manipulation in Mendix applications.

Can CVE-2025-30280 impact my production environment?

Yes, CVE-2025-30280 can significantly impact production environments by exposing them to security risks if not addressed promptly.

Vulnerability/
CVE-2025-30280

medium

6.9

CWE

204

8/4/2025

14/4/2025

CVE-2025-30280

First published: Tue Apr 08 2025(Updated: )

A vulnerability has been identified in Mendix Runtime V10 (All versions < V10.21.0), Mendix Runtime V10.12 (All versions < V10.12.16), Mendix Runtime V10.18 (All versions < V10.18.5), Mendix Runtime V10.6 (All versions < V10.6.22), Mendix Runtime V8 (All versions), Mendix Runtime V9 (All versions < V9.24.34). Affected applications allow for entity enumeration due to distinguishable responses in certain client actions. This could allow an unauthenticated remote attacker to list all valid entities and attribute names of a Mendix Runtime-based application.

Credit: productcert@siemens.com

Affected Software	Affected Version	How to fix
Mendix Runtime	<10.21.0
Mendix Runtime	<10.12.16
Mendix Runtime	<10.18.5
Mendix Runtime	<10.6.22
Mendix Runtime	=8
Mendix Runtime	<9.24.34

Never miss a vulnerability like this again

Reference Links

https://cert-portal.siemens.com/productcert/html/ssa-874353.html

Frequently Asked Questions

What is the severity of CVE-2025-30280?
CVE-2025-30280 is a high-severity vulnerability affecting multiple versions of Mendix Runtime.
How do I fix CVE-2025-30280?
To fix CVE-2025-30280, upgrade to Mendix Runtime version 10.21.0 or later for the affected 10.x versions, or update to the latest patch for 8.x and 9.x versions.
Which versions of Mendix Runtime are affected by CVE-2025-30280?
CVE-2025-30280 affects all versions of Mendix Runtime prior to 10.21.0, as well as versions 10.12, 10.18, 10.6, 8, and all versions prior to 9.24.34.
What types of vulnerabilities are associated with CVE-2025-30280?
CVE-2025-30280 is associated with vulnerabilities that could lead to unauthorized access or data manipulation in Mendix applications.
Can CVE-2025-30280 impact my production environment?
Yes, CVE-2025-30280 can significantly impact production environments by exposing them to security risks if not addressed promptly.

agent/weakness
agent/references
agent/type
agent/first-publish-date
agent/severity
agent/author
agent/source
agent/event
collector/nvd-api
source/NVD
agent/last-modified-date
agent/tags
collector/mitre-cve
source/MITRE
agent/description
agent/softwarecombine
agent/guess-ai
agent/software-canonical-lookup
vendor/mendix
canonical/mendix runtime

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.