CVE-2023-23835: 
Mendix vulnerability analysis and mitigation

A vulnerability (CVE-2023-23835) was identified in Mendix Applications affecting multiple versions including Mendix 7 (< V7.23.34), Mendix 8 (< V8.18.23), Mendix 9 (< V9.22.0), Mendix 9 (V9.12) (< V9.12.10), Mendix 9 (V9.18) (< V9.18.4), and Mendix 9 (V9.6) (< V9.6.15). The vulnerability was discovered in early 2023 and publicly disclosed on February 14, 2023. The issue allows attackers to bypass XPath constraints and retrieve information using XPath queries that trigger errors (CISA, NVD).

The vulnerability is classified as an Improper Access Control issue (CWE-284) affecting the Mendix runtime APIs. It received a CVSS v3.1 base score of 7.5 (HIGH) from NIST with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, while Siemens assessed it with a score of 5.9 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. The difference in scoring primarily relates to the assessment of attack complexity (NVD).

The successful exploitation of this vulnerability could allow an attacker to bypass XPath constraints and retrieve sensitive information using XPath queries that trigger errors. The vulnerability primarily affects the confidentiality of the system, with no direct impact on integrity or availability (CISA).

The vulnerability has a high attack complexity according to Siemens' assessment, though NIST considers it to have low attack complexity. It can be exploited remotely without requiring privileges or user interaction. No known public exploits specifically targeting this vulnerability have been reported (CISA).

Siemens has released updates for all affected versions and recommends users to update to the following versions: Mendix 9 to V9.22.0 or later, Mendix 9 (V9.6) to V9.6.15 or later, Mendix 9 (V9.12) to V9.12.10 or later, Mendix 9 (V9.18) to V9.18.4 or later, Mendix 8 to V8.18.23 or later, and Mendix 7 to V7.23.34 or later. After updating, applications must be redeployed. Additionally, it is recommended to protect network access with appropriate mechanisms and configure the environment according to Siemens' operational guidelines for industrial security (CISA).