Eclipse Mnestix
Monthly
Missing authorization in Eclipse Mnestix Browser 1.2.0 through releases before 2.3.0 lets remote unauthenticated attackers invoke privileged functionality - such as changing Infrastructure settings or calling the connected, authenticated AAS Generator backend - without holding a Mnestix user session. The CVSS 4.0 vector (8.8, AV:N/AC:L/AT:N/PR:N/UI:N, high integrity impact) and the assessed CVSS 3.1 vector agree that no credentials or user interaction are required once the instance is network-reachable, and the issue is tagged as an Authentication Bypass affecting Eclipse Foundation software. The vuln.today decision label is this_week; no public exploit identified at time of analysis, and the advisory's version range indicates 2.3.0 is the first unaffected release.
Eclipse Mnestix Browser 1.6.0 through releases before 2.3.0 allows unauthenticated remote attackers to exfiltrate the MNESTIX_BACKEND_API_KEY for every configured Infrastructure. The issue is classified as CWE-918 (SSRF) with a CVSS 4.0 base score of 9.2 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N), and the independent CVSS 3.1 vector confirms network reachability, no privileges, no user interaction, and high confidentiality impact. No public exploit code or CISA KEV entry is identified at time of analysis, but the priority label is act_now and exploitation requires only that the affected instance be reachable and have at least one Infrastructure configured with such a key.
In Eclipse Mnestix AAS Generator versions 0.1.0 up until but excluding 1.5.0, a practical upper bound on the client-supplied count parameter of the GET /api/v1/IdGenerator/submodelIds/{count} and GET /api/v2/IdGenerator/submodelIds/{count} endpoints is not enforced. The service generates and retains identifiers in memory before returning a response. A remote unauthenticated attacker can submit a large count to cause excessive memory consumption, potentially resulting in denial of service. Exploitation requires network access to the endpoint and successful retrieval of the ID-generation configuration from the configured backend repository.
Missing authorization in Eclipse Mnestix Browser 1.2.0 through releases before 2.3.0 lets remote unauthenticated attackers invoke privileged functionality - such as changing Infrastructure settings or calling the connected, authenticated AAS Generator backend - without holding a Mnestix user session. The CVSS 4.0 vector (8.8, AV:N/AC:L/AT:N/PR:N/UI:N, high integrity impact) and the assessed CVSS 3.1 vector agree that no credentials or user interaction are required once the instance is network-reachable, and the issue is tagged as an Authentication Bypass affecting Eclipse Foundation software. The vuln.today decision label is this_week; no public exploit identified at time of analysis, and the advisory's version range indicates 2.3.0 is the first unaffected release.
Eclipse Mnestix Browser 1.6.0 through releases before 2.3.0 allows unauthenticated remote attackers to exfiltrate the MNESTIX_BACKEND_API_KEY for every configured Infrastructure. The issue is classified as CWE-918 (SSRF) with a CVSS 4.0 base score of 9.2 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N), and the independent CVSS 3.1 vector confirms network reachability, no privileges, no user interaction, and high confidentiality impact. No public exploit code or CISA KEV entry is identified at time of analysis, but the priority label is act_now and exploitation requires only that the affected instance be reachable and have at least one Infrastructure configured with such a key.
In Eclipse Mnestix AAS Generator versions 0.1.0 up until but excluding 1.5.0, a practical upper bound on the client-supplied count parameter of the GET /api/v1/IdGenerator/submodelIds/{count} and GET /api/v2/IdGenerator/submodelIds/{count} endpoints is not enforced. The service generates and retains identifiers in memory before returning a response. A remote unauthenticated attacker can submit a large count to cause excessive memory consumption, potentially resulting in denial of service. Exploitation requires network access to the endpoint and successful retrieval of the ID-generation configuration from the configured backend repository.