CVE-2024-33500 — Siemens / Mendix Applications using Mendix 10

Description (CNA)

A vulnerability has been identified in Mendix Applications using Mendix 10 (All versions < V10.11.0), Mendix Applications using Mendix 10 (V10.6) (All versions < V10.6.9), Mendix Applications using Mendix 9 (All versions >= V9.3.0 < V9.24.22). Affected applications could allow users with the capability to manage a role to elevate the access rights of users with that role. Successful exploitation requires to guess the id of a target role which contains the elevated access rights.

Affected (CNA)

Vendor / product	Versions
Siemens / Mendix Applications using Mendix 10	affected 0 before V10.11.0
Siemens / Mendix Applications using Mendix 10 (V10.6)	affected 0 before V10.6.9
Siemens / Mendix Applications using Mendix 9	affected V9.3.0 before V9.24.22

CWE

CWE-269

References

https://cert-portal.siemens.com/productcert/html/ssa-540640.html

ADP enrichment

CVE

No English description supplied.

https://cert-portal.siemens.com/productcert/html/ssa-540640.html

CISA-ADP

No English description supplied.

No references supplied.