SSA-540640: Improper Privilege Management Vulnerability in Mendix Runtime
Apps built with Mendix Runtime >= V9.3 could allow users with the capability to manage a role to elevate the access rights of users with that role. Successful exploitation requires to guess the id of a target role which contains the elevated access rights. Siemens has released new versions for the affected products and recommends to update to the latest versions.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-33500US | — | — | ||
A vulnerability has been identified in Mendix Applications using Mendix 10 (All versions < V10.11.0), Mendix Applications using Mendix 10 (V10.6) (All versions < V10.6.9), Mendix A… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-540640: Improper Privilege Management Vulnerability in Mendix Runtime - CSAF Versionself
- SSA-540640: Improper Privilege Management Vulnerability in Mendix Runtime - HTML Versionself
- SSA-540640: Improper Privilege Management Vulnerability in Mendix Runtime - PDF Versionself
- SSA-540640: Improper Privilege Management Vulnerability in Mendix Runtime - TXT Versionself
Behebungen (6)
- MitigationMendix Applications using Mendix 10
Set the runtime setting StrictReferenceChecks to false; note however, that this comes at the price of making the reference checks less secure
- MitigationMendix Applications using Mendix 10 (V10.6)
Set the runtime setting StrictReferenceChecks to false; note however, that this comes at the price of making the reference checks less secure
- MitigationMendix Applications using Mendix 9
Set the runtime setting StrictReferenceChecks to false; note however, that this comes at the price of making the reference checks less secure
- BehobenMendix Applications using Mendix 10
Update to V10.11.0 or later version
- BehobenMendix Applications using Mendix 10 (V10.6)
Update to V10.6.9 or later version
- BehobenMendix Applications using Mendix 9
Update to V9.24.22 or later version
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan