CVE-2024-39888 | THREATINT

Description

A vulnerability has been identified in Mendix Encryption (All versions >= V10.0.0 < V10.0.2). Affected versions of the module define a specific hard-coded default value for the EncryptionKey constant, which is used in projects where no individual EncryptionKey was specified. This could allow to an attacker to decrypt any encrypted project data, as the default encryption key can be considered compromised.

PUBLISHED Reserved 2024-07-02 | Published 2024-07-09 | Updated 2025-08-27 | Assigner siemens

HIGH: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

HIGH: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Problem types

CWE-547: Use of Hard-coded, Security-relevant Constants

Product status

Default status

unknown

V10.0.0 (custom) before V10.0.2

affected

References

cert-portal.siemens.com/productcert/html/ssa-998949.html

cve.org (CVE-2024-39888)

nvd.nist.gov (CVE-2024-39888)

Download JSON