Vulnerability · Published Jun 11, 2024 · Assigned by siemens
CVE-2024-33500
Medium 5.9
In plain English
A medium-severity privilege mismanagement in Mendix Applications using Mendix 10 from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).
Official description
A vulnerability has been identified in Mendix Applications using Mendix 10 (All versions < V10.11.0), Mendix Applications using Mendix 10 (V10.6) (All versions < V10.6.9), Mendix Applications using Mendix 9 (All versions >= V9.3.0 < V9.24.22). Affected applications could allow users with the capability to manage a role to elevate the access rights of users with that role. Successful exploitation requires to guess the id of a target role which contains the elevated access rights.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Siemens | Mendix Applications using Mendix 10 | 0 – before V10.11.0 |
| Siemens | Mendix Applications using Mendix 10 (V10.6) | 0 – before V10.6.9 |
| Siemens | Mendix Applications using Mendix 9 | V9.3.0 – before V9.24.22 |
Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N