CVE-2024-39888CWE-547

A vulnerability has been identified in Mendix Encryption (All versions >= V10.0.0 < V10.0.2)

High · published July 9, 2024

CVSS v4.0
8.7
EPSS
0%
Percentile
14.7
In the wild
Unconfirmed
What it is

A vulnerability has been identified in Mendix Encryption (All versions >= V10.0.0 < V10.0.2). Affected versions of the module define a specific hard-coded default value for the EncryptionKey constant, which is used in projects where no individual EncryptionKey was specified.

This could allow to an attacker to decrypt any encrypted project data, as the default encryption key can be considered compromised.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00244 · 14.7th percentile
Weakness
CWE-547 · Use of Hard-coded, Security-relevant Constants
Published
2024-07-09T12:05Z
EPSS history
Timeline
  • 09 JUL 12:05Z
    A vulnerability has been identified in Mendix Encryption (All versions >= V10.0.0 < V10.0.2)
    cvelistv5