CVE-2025-40758

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-40758", "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "state": "PUBLISHED", "assignerShortName": "siemens", "dateReserved": "2025-04-16T08:39:30.031Z", "datePublished": "2025-08-14T15:06:31.691Z", "dateUpdated": "2025-08-14T15:18:47.716Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "shortName": "siemens", "dateUpdated": "2025-08-14T15:06:31.691Z"}, "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in Mendix SAML (Mendix 10.12 compatible) (All versions < V4.0.3), Mendix SAML (Mendix 10.21 compatible) (All versions < V4.1.2), Mendix SAML (Mendix 9.24 compatible) (All versions < V3.6.21). Affected versions of the module insufficiently enforce signature validation and binding checks. This could allow unauthenticated remote attackers to hijack an account in specific SSO configurations."}], "affected": [{"vendor": "Siemens", "product": "Mendix SAML (Mendix 10.12 compatible)", "versions": [{"status": "affected", "version": "0", "lessThan": "V4.0.3", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "Mendix SAML (Mendix 10.21 compatible)", "versions": [{"status": "affected", "version": "0", "lessThan": "V4.1.2", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "Mendix SAML (Mendix 9.24 compatible)", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.6.21", "versionType": "custom"}], "defaultStatus": "unknown"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "baseScore": 8.7, "baseSeverity": "HIGH"}}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-347", "description": "CWE-347: Improper Verification of Cryptographic Signature", "type": "CWE"}]}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-395458.html"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-14T15:18:38.766906Z", "id": "CVE-2025-40758", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-14T15:18:47.716Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-40758", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-08-14T15:18:38.766906Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-14T15:18:42.745Z"}}], "cna": {"metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N"}}], "affected": [{"vendor": "Siemens", "product": "Mendix SAML (Mendix 10.12 compatible)", "versions": [{"status": "affected", "version": "0", "lessThan": "V4.0.3", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "Mendix SAML (Mendix 10.21 compatible)", "versions": [{"status": "affected", "version": "0", "lessThan": "V4.1.2", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "Mendix SAML (Mendix 9.24 compatible)", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.6.21", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-395458.html"}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in Mendix SAML (Mendix 10.12 compatible) (All versions < V4.0.3), Mendix SAML (Mendix 10.21 compatible) (All versions < V4.1.2), Mendix SAML (Mendix 9.24 compatible) (All versions < V3.6.21). Affected versions of the module insufficiently enforce signature validation and binding checks. This could allow unauthenticated remote attackers to hijack an account in specific SSO configurations."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-347", "description": "CWE-347: Improper Verification of Cryptographic Signature"}]}], "providerMetadata": {"orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "shortName": "siemens", "dateUpdated": "2025-08-14T15:06:31.691Z"}}}, "cveMetadata": {"cveId": "CVE-2025-40758", "state": "PUBLISHED", "dateUpdated": "2025-08-14T15:18:47.716Z", "dateReserved": "2025-04-16T08:39:30.031Z", "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "datePublished": "2025-08-14T15:06:31.691Z", "assignerShortName": "siemens"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Mendix SAML (Mendix 10.12 compatible)", "vendor": "Siemens", "versions": [{"lessThan": "V4.0.3", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "Mendix SAML (Mendix 10.21 compatible)", "vendor": "Siemens", "versions": [{"lessThan": "V4.1.2", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "Mendix SAML (Mendix 9.24 compatible)", "vendor": "Siemens", "versions": [{"lessThan": "V3.6.21", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "productcert@siemens.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in Mendix SAML (Mendix 10.12 compatible) (All versions < V4.0.3), Mendix SAML (Mendix 10.21 compatible) (All versions < V4.1.2), Mendix SAML (Mendix 9.24 compatible) (All versions < V3.6.21). Affected versions of the module insufficiently enforce signature validation and binding checks. This could allow unauthenticated remote attackers to hijack an account in specific SSO configurations."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad en Mendix SAML (compatible con Mendix 10.12) (todas las versiones anteriores a la V4.0.3), Mendix SAML (compatible con Mendix 10.21) (todas las versiones anteriores a la V4.1.2) y Mendix SAML (compatible con Mendix 9.24) (todas las versiones anteriores a la V3.6.21). Las versiones afectadas del m\u00f3dulo no aplican correctamente la validaci\u00f3n de firmas ni las comprobaciones de vinculaci\u00f3n. Esto podr\u00eda permitir que atacantes remotos no autenticados secuestren una cuenta en configuraciones de SSO espec\u00edficas."}], "id": "CVE-2025-40758", "lastModified": "2026-06-17T09:22:04.977", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.8, "source": "productcert@siemens.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-40758", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-08-14T15:18:38.766906Z", "version": "2.0.3"}}]}, "published": "2025-08-14T15:15:36.133", "references": [{"source": "productcert@siemens.com", "url": "https://cert-portal.siemens.com/productcert/html/ssa-395458.html"}], "sourceIdentifier": "productcert@siemens.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-347"}], "source": "productcert@siemens.com", "type": "Secondary"}]}

{}

{"created": "2025-08-15T08:07:50.156557+00:00", "updated": "2025-08-15T08:07:50.156605+00:00", "vendors": ["mendix", "mendix$PRODUCT$mendix", "mendix$PRODUCT$saml"]}