CVE-2025-30280: Medium severity Mendix Runtime V10 vulnerability
A vulnerability has been identified in Mendix Runtime V10 (All versions < V10.21.0), Mendix Runtime V10.12 (All versions < V10.12.16), Mendix Runtime V10.18 (All versions < V10.18.5), Mendix Runtime V10.6 (All versions < V10.6.22), Mendix Runtime V8 (All versions < V8.18.35), Mendix Runtime V9 (All versions < V9.24.34). Affected applications allow for entity enumeration due to distinguishable responses in certain client actions. This could allow an unauthenticated remote attacker to list all valid entities and attribute names of a Mendix Runtime-based application.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-30280?
CVE-2025-30280 is a high-severity vulnerability affecting multiple versions of Mendix Runtime.
How do I fix CVE-2025-30280?
To fix CVE-2025-30280, upgrade to Mendix Runtime version 10.21.0 or later for the affected 10.x versions, or update to the latest patch for 8.x and 9.x versions.
Which versions of Mendix Runtime are affected by CVE-2025-30280?
CVE-2025-30280 affects all versions of Mendix Runtime prior to 10.21.0, as well as versions 10.12, 10.18, 10.6, 8, and all versions prior to 9.24.34.
What types of vulnerabilities are associated with CVE-2025-30280?
CVE-2025-30280 is associated with vulnerabilities that could lead to unauthorized access or data manipulation in Mendix applications.
Can CVE-2025-30280 impact my production environment?
Yes, CVE-2025-30280 can significantly impact production environments by exposing them to security risks if not addressed promptly.