Read the docs
TI-2024-22093 Aliases CVE-2024-33500GHSA-497q-xhqw-fw3m

Improper privilege management in Siemens Mendix Applications using Mendix 10

Priority LOW 34CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-269.

Summary

A vulnerability has been identified in Mendix Applications using Mendix 10 (All versions < V10.11.0), Mendix Applications using Mendix 10 (V10.6) (All versions < V10.6.9), Mendix Applications using Mendix 9 (All versions >= V9.3.0 < V9.24.22). Affected applications could allow users with the capability to manage a role to elevate the access rights of users with that role. Successful exploitation requires to guess the id of a target role which contains the elevated access rights.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00298 22nd percentileScored 2026-11-07
Fix Fixed Mendix Applications using Mendix 10 (Siemens): V10.11.0Mendix Applications using Mendix 10 (V10.6) (Siemens): V10.6.9+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensMendix Applications using Mendix 10before V10.11.0V10.11.0Patch availableCNA
SiemensMendix Applications using Mendix 10 (V10.6)before V10.6.9V10.6.9Patch availableCNA
SiemensMendix Applications using Mendix 9V9.3.0 to before V9.24.22V9.24.22Patch availableCNA
  • Mendix Applications using Mendix 10 VendorSiemens Affected before V10.11.0 Fixed in V10.11.0 Patch available CNA
  • Mendix Applications using Mendix 10 (V10.6) VendorSiemens Affected before V10.6.9 Fixed in V10.6.9 Patch available CNA
  • Mendix Applications using Mendix 9 VendorSiemens Affected V9.3.0 to before V9.24.22 Fixed in V9.24.22 Patch available CNA

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:siemens:mendix:*:*:*:*:*:*:*:*——Siemens
  • cpe:2.3:a:siemens:mendix:*:*:*:*:*:*:*:* Versions — — ·Siemens

Remediation

  • Fix · CNA Mendix Applications using Mendix 10 (Siemens) Fixed in V10.11.0
  • Fix · CNA Mendix Applications using Mendix 10 (V10.6) (Siemens) Fixed in V10.6.9
  • Fix · CNA Mendix Applications using Mendix 9 (Siemens) Fixed in V9.24.22

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-33500
  2. 2026-10-03 Alias added: GHSA-497q-xhqw-fw3m

References

Other 1

  • TI-2026-20057 Authentication bypass in Fortinet FortiWeb KEVCVSS 3.1CRITICAL 9.4
  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-18911 Heap-based buffer overflow in Fortinet FortiSwitchManager KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
See all 2487 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences