{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "The basic authentication mechanism of Mendix Runtime contains a race condition vulnerability which could allow unauthenticated remote attackers to circumvent default account lockout measures.\n\nSiemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: \nhttps://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: \nhttps://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "productcert@siemens.com",
      "name": "Siemens ProductCERT",
      "namespace": "https://www.siemens.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-914892: Race Condition Vulnerability in Basic Authentication Implementation of Mendix Runtime - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-914892.html"
      },
      {
        "category": "self",
        "summary": "SSA-914892: Race Condition Vulnerability in Basic Authentication Implementation of Mendix Runtime - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-914892.json"
      }
    ],
    "title": "SSA-914892: Race Condition Vulnerability in Basic Authentication Implementation of Mendix Runtime",
    "tracking": {
      "current_release_date": "2024-11-12T00:00:00Z",
      "generator": {
        "engine": {
          "name": "Siemens ProductCERT CSAF Generator",
          "version": "1"
        }
      },
      "id": "SSA-914892",
      "initial_release_date": "2024-11-12T00:00:00Z",
      "revision_history": [
        {
          "date": "2024-11-12T00:00:00Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        }
      ],
      "status": "interim",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Mendix Runtime V8",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "Mendix Runtime V8"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/\u003cV9.24.29",
                "product": {
                  "name": "Mendix Runtime V9",
                  "product_id": "2"
                }
              }
            ],
            "category": "product_name",
            "name": "Mendix Runtime V9"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/\u003cV10.16.0",
                "product": {
                  "name": "Mendix Runtime V10",
                  "product_id": "3"
                }
              }
            ],
            "category": "product_name",
            "name": "Mendix Runtime V10"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/\u003cV10.6.15",
                "product": {
                  "name": "Mendix Runtime V10.6",
                  "product_id": "4"
                }
              }
            ],
            "category": "product_name",
            "name": "Mendix Runtime V10.6"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/\u003cV10.12.7",
                "product": {
                  "name": "Mendix Runtime V10.12",
                  "product_id": "5"
                }
              }
            ],
            "category": "product_name",
            "name": "Mendix Runtime V10.12"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-50313",
      "cwe": {
        "id": "CWE-362",
        "name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The basic authentication implementation of affected applications contains a race condition vulnerability which could allow unauthenticated remote attackers to circumvent default account lockout measures.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "3",
          "5",
          "4",
          "1",
          "2"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Do not use basic authentication, but setup an alternative authentication module (e.g. SAML, MendixSSO), or your own Identity Provider (IDP)",
          "product_ids": [
            "3",
            "5",
            "4",
            "1",
            "2"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "Currently no fix is planned",
          "product_ids": [
            "1"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V10.12.7 or later version",
          "product_ids": [
            "5"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V10.16.0 or later version",
          "product_ids": [
            "3"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V10.6.15 or later version",
          "product_ids": [
            "4"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V9.24.29 or later version",
          "product_ids": [
            "2"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "3",
            "5",
            "4",
            "1",
            "2"
          ]
        }
      ],
      "title": "CVE-2024-50313"
    }
  ]
}