Incorrect authorization in Siemens Mendix Applications using Mendix 7
Priority LOW 25CWE-863Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-863.
Summary
A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.22), Mendix Applications using Mendix 8 (All versions < V8.18.7), Mendix Applications using Mendix 9 (All versions < V9.3.0). Write access checks of attributes of an object could be bypassed, if user has a write permissions to the first attribute of this object.
Why it matters now
EPSS 0.00581 47th percentileScored 2026-11-07
Fix Fixed Mendix Applications using Mendix 7 (Siemens): V7.23.22Mendix Applications using Mendix 8 (Siemens): V8.18.7+1 more product
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Siemens | Mendix Applications using Mendix 7 | before V7.23.22 | V7.23.22 | Patch available | CNA |
| Siemens | Mendix Applications using Mendix 8 | before V8.18.7 | V8.18.7 | Patch available | CNA |
| Siemens | Mendix Applications using Mendix 9 | before V9.3.0 | V9.3.0 | Patch available | CNA |
- Mendix Applications using Mendix 7 VendorSiemens Affected before V7.23.22 Fixed in V7.23.22 Patch available CNA
- Mendix Applications using Mendix 8 VendorSiemens Affected before V8.18.7 Fixed in V8.18.7 Patch available CNA
- Mendix Applications using Mendix 9 VendorSiemens Affected before V9.3.0 Fixed in V9.3.0 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:siemens:mendix:*:*:*:*:*:*:*:* | 7.0 to before 7.23.22; 8.0 to before 8.18.7; 9.0 to before 9.3.0 | Vulnerable | Siemens |
- cpe:2.3:a:siemens:mendix:*:*:*:*:*:*:*:* Versions 7.0 to before 7.23.22; 8.0 to before 8.18.7; 9.0 to before 9.3.0 Vulnerable ·Siemens
Remediation
- Fix · CNA Mendix Applications using Mendix 7 (Siemens) Fixed in V7.23.22
- Fix · CNA Mendix Applications using Mendix 8 (Siemens) Fixed in V8.18.7
- Fix · CNA Mendix Applications using Mendix 9 (Siemens) Fixed in V9.3.0
Timeline
- 2026-10-02 Threatist record created from CVE-2021-33718
- 2026-10-03 Alias added: GHSA-rhfw-f382-2fcr
References
More Siemens Mendix vulnerabilities
- TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
- TI-2021-20393 Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack KEVCVSS 3.1CRITICAL 9.0
- TI-2023-24556 Authentication bypass by capture-replay in Siemens Mendix Applications using Mendix 10 CVSS 3.1HIGH 8.1
Sources
- CVE-2021-33718 · CVE Program
- CVE-2021-33718 · NVD
- FIRST EPSS
- GHSA-rhfw-f382-2fcr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences