CVE-2025-30280 Information disclosure in Mendix Runtime V10
Unauthenticated attackers can enumerate valid entities and attributes in Mendix Runtime applications due to distinguishable responses.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-30280?
CVE-2025-30280 is a medium-severity vulnerability in Siemens Mendix Runtime V10, published on 8 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability has been identified in Mendix Runtime V10 (All versions < V10.21.0), Mendix Runtime V10.12 (All versions < V10.12.16), Mendix Runtime V10.18 (All versions < V10.18.5), Mendix Runtime V10.6 (All versions < V10.6.22), Mendix Runtime V8 (All versions < V8.18.35), Mendix Runtime V9 (All versions < V9.24.34). Affected applications allow for entity enumeration due to distinguishable responses in certain client actions. This could allow an unauthenticated remote attacker to list all valid entities and attribute names of a Mendix Runtime-based application.
Weakness: CWE-204
Which versions are affected by CVE-2025-30280?
How do I fix CVE-2025-30280?
No fix has been published for CVE-2025-30280 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-30280 being exploited?
There is no known exploitation of CVE-2025-30280 in the wild and no public exploit code.
Sources
Also known as GHSA-f7j7-j734-vm9x.