SSA-540640: Improper Privilege Management Vulnerability in Mendix Runtime
Apps built with Mendix Runtime >= V9.3 could allow users with the capability to manage a role to elevate the access rights of users with that role. Successful exploitation requires to guess the id of a target role which contains the elevated access rights. Siemens has released new versions for the affected products and recommends to update to the latest versions.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-33500US | — | — | ||
A vulnerability has been identified in Mendix Applications using Mendix 10 (All versions < V10.11.0), Mendix Applications using Mendix 10 (V10.6) (All versions < V10.6.9), Mendix A… | ||||
references
External citations — patches, advisories, analysis.
- SSA-540640: Improper Privilege Management Vulnerability in Mendix Runtime - CSAF Versionself
- SSA-540640: Improper Privilege Management Vulnerability in Mendix Runtime - HTML Versionself
- SSA-540640: Improper Privilege Management Vulnerability in Mendix Runtime - PDF Versionself
- SSA-540640: Improper Privilege Management Vulnerability in Mendix Runtime - TXT Versionself
remediations (6)
- MitigationMendix Applications using Mendix 10
Set the runtime setting StrictReferenceChecks to false; note however, that this comes at the price of making the reference checks less secure
- MitigationMendix Applications using Mendix 10 (V10.6)
Set the runtime setting StrictReferenceChecks to false; note however, that this comes at the price of making the reference checks less secure
- MitigationMendix Applications using Mendix 9
Set the runtime setting StrictReferenceChecks to false; note however, that this comes at the price of making the reference checks less secure
- FixedMendix Applications using Mendix 10
Update to V10.11.0 or later version
- FixedMendix Applications using Mendix 10 (V10.6)
Update to V10.6.9 or later version
- FixedMendix Applications using Mendix 9
Update to V9.24.22 or later version
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan