5.9
Medium
CVE-2024-33500 A vulnerability has been identified in Mendix Applications using Mendix 10 (All versions < V10.11.0), Mendix…
Description
A vulnerability has been identified in Mendix Applications using Mendix 10 (All versions < V10.11.0), Mendix Applications using Mendix 10 (V10.6) (All versions < V10.6.9), Mendix Applications using Mendix 9 (All versions >= V9.3.0 < V9.24.22). Affected applications could allow users with the capability to manage a role to elevate the access rights of users with that role. Successful exploitation requires to guess the id of a target role which contains the elevated access rights.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Mendix Applications using Mendix 10 10.11 | earliest → < 10.11.0 | 10.11.0 |
| Mendix Applications using Mendix 10 (V10.6) 10.6 | earliest → < 10.6.9 | 10.6.9 |
| Mendix Applications using Mendix 9 9.3 | 9.3.0 → < 9.24.22 | 9.24.22 |
| mendix 10.11 | earliest → < 10.11.0 | 10.11.0 |
| mendix 10.6 | 10.6 → < 10.6.9 | 10.6.9 |
| mendix 9.3 | 9.3.0 → < 9.24.22 | 9.24.22 |