5.3
CVE-2023-27464
- EPSS 0.46%
- Veröffentlicht 11.04.2023 10:15:18
- Zuletzt bearbeitet 21.11.2024 07:52:57
- Erkennungen
LoginA vulnerability has been identified in Mendix Forgot Password (Mendix 7 compatible) (All versions < V3.7.1), Mendix Forgot Password (Mendix 8 compatible) (All versions < V4.1.1), Mendix Forgot Password (Mendix 9 compatible) (All versions < V5.1.1). The affected versions of the module contain an observable response discrepancy issue that could allow an attacker to retrieve sensitive information.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mendix ≫ Forgot Password Version < 3.7.1
Mendix ≫ Forgot Password Version >= 4.0.0 < 4.1.1
Mendix ≫ Forgot Password Version >= 5.0.0 < 5.1.1
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.46% | 0.362 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| Siemens | 5.3 | 3.9 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
|
CWE-203 Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
CWE-204 Observable Response Discrepancy
The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.
https://cert-portal.siemens.com/productcert/pdf/ssa-699404.pdf