5.3
Medium
CVE-2025-30280 A vulnerability has been identified in Mendix Runtime V10 (All versions < V10.21.0), Mendix Runtime V10.12 (All versions…
Description
A vulnerability has been identified in Mendix Runtime V10 (All versions < V10.21.0), Mendix Runtime V10.12 (All versions < V10.12.16), Mendix Runtime V10.18 (All versions < V10.18.5), Mendix Runtime V10.6 (All versions < V10.6.22), Mendix Runtime V8 (All versions < V8.18.35), Mendix Runtime V9 (All versions < V9.24.34). Affected applications allow for entity enumeration due to distinguishable responses in certain client actions. This could allow an unauthenticated remote attacker to list all valid entities and attribute names of a Mendix Runtime-based application.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Mendix Runtime V10 10.21 | earliest → < 10.21.0 | 10.21.0 |
| Mendix Runtime V10.12 10.12 | earliest → < 10.12.16 | 10.12.16 |
| Mendix Runtime V10.18 10.18 | earliest → < 10.18.5 | 10.18.5 |
| Mendix Runtime V10.6 10.6 | earliest → < 10.6.22 | 10.6.22 |
| Mendix Runtime V8 8.18 | earliest → < 8.18.35 | 8.18.35 |
| Mendix Runtime V9 9.24 | earliest → < 9.24.34 | 9.24.34 |