TI-2021-11485 Aliases CVE-2021-31341 GHSA-99j4-r9vg-37r9

Information disclosure through error messages in Mendix Database Replication Module

LOW 21CWE-209Published 2021-05-12 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-209.

Summary

Uploading a table mapping using a manipulated XML file results in an exception that could expose information about the application-server and the used XML-framework on the Mendix Database Replication Module (All versions prior to v7.0.1).

Why it matters now

EPSS 0.00721 54th percentileScored 2026-11-07

Fix Fixed Mendix Database Replication Module: v7.0.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	Mendix Database Replication Module	before v7.0.1	v7.0.1	Patch available	CNA

Mendix Database Replication Module Vendor— Affected before v7.0.1 Fixed in v7.0.1 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:mendix:database_replication::::::::	before 7.0.1	Vulnerable	Mendix

cpe:2.3:a:mendix:database_replication:*:*:*:*:*:*:*:* Versions before 7.0.1 Vulnerable ·Mendix

Remediation

Fix · CNA Mendix Database Replication Module Fixed in v7.0.1

Timeline

2026-10-02 Threatist record created from CVE-2021-31341
2026-10-03 Alias added: GHSA-99j4-r9vg-37r9

References

Advisory 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences