The S-Unit Mendix Top 10
Inspired by OWASP and shaped by more than 10 years of offensive security experience, The S-Unit Top 10 reveals the Mendix-specific vulnerabilities that can open the door to an attack
Based on insights from hundreds of Mendix penetration tests.
Check the most common vulnerabilities in Mendix
TSU-01: Insecure user roles
A correctly configured module role linked to the wrong user role can give users access they were never meant to have.
TSU-02: Insecure entity access
The entity access rule itself is incorrectly configured, exposing data regardless of which user role it is linked to.
TSU-03: Insecure microflows
Insecure microflow implementations, such as missing or insufficient authorization, can allow attackers to manipulate application behavior, trigger microflows and execute functionality they should not have access to.
TSU-04: Insecure published integrations
Weakly secured published integrations can expose sensitive data or functionality to external attackers.
TSU-05: Insecure consumption of integrations
Insufficient validation of data from external integrations can allow attackers to manipulate the application through untrusted input.
TSU-06: Use of outdated or end-of-life components
Outdated or unsupported components can expose the application to known vulnerabilities that are no longer patched.
TSU-07: Insecure custom authentication
Flaws in custom authentication can allow attackers to bypass login controls or gain access as another user.
TSU-08: Insecure custom Java
Insecure custom Java can introduce vulnerabilities that bypass Mendix’s built-in security controls.
TSU-09: Insecure UI components
Insecure custom or third-party UI components can introduce client-side vulnerabilities that attackers can exploit.
TSU-10: Insecure cloud deployments
Misconfigured cloud deployments can disclose details about the system or make the application more susceptible to attacks.
FAQ
What is the difference between the OWASP Top 10 and The S-Unit Top 10?
The OWASP Top 10 describes security risks for web applications in general. The S-Unit Top 10 focuses specifically on vulnerabilities we encounter in practice within applications built on the Mendix platform.
How can I protect my Mendix application against these vulnerabilities?
Regular penetration tests and security audits help identify vulnerabilities, while our Mendix-specific SAST solution with Omnext continuously scans for The S-Unit Top 10. Integrated into the CI/CD pipeline, it catches security risks early and reduces the reliance on manual testing.
Want to know if your Mendix application
has these vulnerabilities?
Whether you’re facing a specific challenge or want to look at your security from a different angle, we’ll think it through with you and explore where an offensive approach makes the difference.