CVE-2024-39888

Summary

A vulnerability has been identified in Mendix Encryption (All versions >= V10.0.0 < V10.0.2). Affected versions of the module define a specific hard-coded default value for the EncryptionKey constant, which is used in projects where no individual EncryptionKey was specified.

This could allow to an attacker to decrypt any encrypted project data, as the default encryption key can be considered compromised.

Affected Software

VendorProductVersion RangeStatus
SiemensMendix EncryptionV10.0.0 < V10.0.2affected

Weaknesses

  • CWE-547: CWE-547: Use of Hard-coded, Security-relevant Constants

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

CVE Program Container

Additional References

References