Description
A vulnerability has been identified in Mendix Applications using Mendix 10 (All versions < V10.11.0), Mendix Applications using Mendix 10 (V10.6) (All versions < V10.6.9), Mendix Applications using Mendix 9 (All versions >= V9.3.0 < V9.24.22). Affected applications could allow users with the capability to manage a role to elevate the access rights of users with that role. Successful exploitation requires to guess the id of a target role which contains the elevated access rights.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Siemens | Mendix Applications using Mendix 10 | < V10.11.0 | V10.11.0 |
| Siemens | Mendix Applications using Mendix 10 (V10.6) | < V10.6.9 | V10.6.9 |
| Siemens | Mendix Applications using Mendix 9 | V9.3.0 – < V9.24.22 | V9.24.22 |
Advisories 3
- NCSC-2024-0246 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Jun 11, 2024
- ICSA-24-165-01 Siemens Mendix Applications CISA ICS & IT advisories · Jun 11, 2024
- SSA-540640 SSA-540640: Improper Privilege Management Vulnerability in Mendix Runtime Siemens ProductCERT · Jun 11, 2024