CVE-2024-33500

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-06-11 · updated 2026-06-17
Weakness: CWE-269

Description

A vulnerability has been identified in Mendix Applications using Mendix 10 (All versions < V10.11.0), Mendix Applications using Mendix 10 (V10.6) (All versions < V10.6.9), Mendix Applications using Mendix 9 (All versions >= V9.3.0 < V9.24.22). Affected applications could allow users with the capability to manage a role to elevate the access rights of users with that role. Successful exploitation requires to guess the id of a target role which contains the elevated access rights.

Affected products

Siemens Mendix: from 10..0 before 10.11.0; from 10.6 before 10.6.9; from 9.3.0 before 9.24.22 — fixed in 10.11.0, 10.6.9, 9.24.22

How to fix

Upgrade to a fixed version: Siemens Mendix 10.11.0, 10.6.9, 9.24.22. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-33500 or the next vulnerability affects your stack