CVE-2023-29129

A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.17.3 < V1.18.0), Mendix SAML (Mendix 7 compatible) (All versions >= V1.16.4 < V1.17.3), Mendix SAML (Mendix 8 compatible) (All versions >= V2.3.0 < V2.4.0), Mendix SAML (Mendix 8 compatible) (All versions >= V2.2.0 < V2.3.0), Mendix SAML (Mendix 9 latest compatible, New Track) (All versions >= V3.3.1 < V3.6.1), Mendix SAML (Mendix 9 latest compatible, New Track) (All versions >= V3.1.9 < V3.3.1), Mendix SAML (Mendix 9 latest compatible, Upgrade Track) (All versions >= V3.3.0 < V3.6.0), Mendix SAML (Mendix 9 latest compatible, Upgrade Track) (All versions >= V3.1.8 < V3.3.0), Mendix SAML (Mendix 9.12/9.18 compatible, New Track) (All versions >= V3.3.1 < V3.3.15), Mendix SAML (Mendix 9.12/9.18 compatible, Upgrade Track) (All versions >= V3.3.0 < V3.3.14), Mendix SAML (Mendix 9.6 compatible, New Track) (All versions >= V3.1.9 < V3.2.7), Mendix SAML (Mendix 9.6 compatible, Upgrade Track) (All versions >= V3.1.8 < V3.2.6). The affected versions of the module insufficiently verify the SAML assertions. This could allow unauthenticated remote attackers to bypass authentication and get access to the application. This CVE entry describes the incomplete fix for CVE-2023-25957 in a specific non default configuration.

• CWE-303
• CWE-287

• https://cert-portal.siemens.com/productcert/pdf/ssa-851884.pdfPatch, Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-851884.pdfPatch, Vendor Advisory

Published

Jun 13, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-29120Waybox Enel X web management application could be used to ex…8.8
• CVE-2023-29121Waybox Enel TCF Agent service could be used to get administr…8.8
• CVE-2023-29122Under certain conditions, access to service libraries is gra…6.7
• CVE-2023-29125A heap buffer overflow could be triggered by sending a speci…8
• CVE-2023-29126The Waybox Enel X web management application contains a PHP-…8.8
• CVE-2023-29128A vulnerability has been identified in SIMATIC Cloud Connect…2.7
• CVE-2023-2913 An executable used in Rockwell Automation ThinManager ThinS…6.5
• CVE-2023-29130A vulnerability has been identified in SIMATIC CN 4100 (All …10
• CVE-2023-29131A vulnerability has been identified in SIMATIC CN 4100 (All …10
• CVE-2023-29132Irssi 1.3.x and 1.4.x before 1.4.4 has a use-after-free beca…5.3
• CVE-2023-29134An issue was discovered in the Cargo extension for MediaWiki…8.6
• CVE-2023-29137An issue was discovered in the GrowthExperiments extension f…4.3