CVE-2023-25957 - CVE House
Back to Database
Status published Critical CVE-2023-25957

A vulnerability has been identified in Mendix SAML (Mendix 7...

Vulnerability Description

A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.16.4 < V1.17.3), Mendix SAML (Mendix 8 compatible) (All versions >= V2.2.0 < V2.3.0), Mendix SAML (Mendix 9 latest compatible, New Track) (All versions >= V3.1.9 < V3.3.1), Mendix SAML (Mendix 9 latest compatible, Upgrade Track) (All versions >= V3.1.8 < V3.3.0), Mendix SAML (Mendix 9.6 compatible, New Track) (All versions >= V3.1.9 < V3.2.7), Mendix SAML (Mendix 9.6 compatible, Upgrade Track) (All versions >= V3.1.8 < V3.2.6). The affected versions of the module insufficiently verify the SAML assertions. This could allow unauthenticated remote attackers to bypass authentication and get access to the application. For compatibility reasons, fix versions still contain this issue, but only when the recommended, default configuration option `'Use Encryption'` is disabled.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-25957

Credits & Attribution

No credits recorded in the NVD database.

References

More from Siemens

View All →
CVE-2025-41224
A vulnerability has been identified in RUGGEDCOM RMC8388 V5.X (All...
High 7.7
CVE-2025-41223
A vulnerability has been identified in RUGGEDCOM i800 (All versions),...
Medium 6.3
CVE-2025-41222
A vulnerability has been identified in RUGGEDCOM i800 (All versions),...
Medium 6.9
CVE-2025-40949
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All...
High 8.9
CVE-2025-40948
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All...
Medium 6.1

Affected Vendor

Affected Software

Mendix SAML (Mendix 7 compatible), Mendix SAML (Mendix 8 compatible), Mendix SAML (Mendix 9 latest compatible, New Track), Mendix SAML (Mendix 9 latest compatible, Upgrade Track), Mendix SAML (Mendix 9.6 compatible, New Track), Mendix SAML (Mendix 9.6 compatible, Upgrade Track)
Vulnerable Versions:
All versions >= V1.16.4 < V1.17.3, All versions >= V2.2.0 < V2.3.0, All versions >= V3.1.9 < V3.3.1, All versions >= V3.1.8 < V3.3.0, All versions >= V3.1.9 < V3.2.7, All versions >= V3.1.8 < V3.2.6

Timeline

Official Publish: March 14th, 2023
Last Modified: February 27th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C

Weaknesses (CWE)

CWE-303

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.