CVE-2024-33500
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-33500
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
A vulnerability has been identified in Mendix Applications using Mendix 10 (All versions < V10.11.0), Mendix Applications using Mendix 10 (V10.6) (All versions < V10.6.9), Mendix Applications using Mendix 9 (All versions >= V9.3.0 < V9.24.22). Affected applications could allow users with the capability to manage a role to elevate the access rights of users with that role. Successful exploitation requires to guess the id of a target role which contains the elevated access rights.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
特权管理不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
多款Siemens产品 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Siemens Mendix是德国西门子（Siemens）公司的一套低代码应用程序开发平台。该平台提供应用程序开发、测试、部署和迭代等功能。 多款Siemens产品存在安全漏洞，该漏洞源于受影响的应用程序可能允许具有管理角色权限的用户提升具有该角色的用户的访问权限，以下产品和版本受到影响：Mendix10 V10.11.0之前版本、 Mendix 10 V10.6.9之前版本、 Mendix 9 V9.3.0 到 V9.24.22版本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Siemens | Mendix Applications using Mendix 10 | 0 ~ V10.11.0 | - | |
| Siemens | Mendix Applications using Mendix 10 (V10.6) | 0 ~ V10.6.9 | - | |
| Siemens | Mendix Applications using Mendix 9 | V9.3.0 ~ V9.24.22 | - |
II. Public POCs for CVE-2024-33500
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-33500
请登录查看更多情报信息。
Same Patch Batch · Siemens · 2024-06-11 · 14 CVEs total
| CVE-2024-36266 | 9.3 CRITICAL | Siemens PowerSys 授权问题漏洞 |
| CVE-2024-35292 | 8.2 HIGH | 多款Siemens产品 安全特征问题漏洞 |
| CVE-2024-35207 | 7.8 HIGH | Siemens SINEC Traffic Analyzer 跨站请求伪造漏洞 |
| CVE-2024-35303 | 7.8 HIGH | Siemens Tecnomatix Plant Simulation 代码问题漏洞 |
| CVE-2024-35206 | 7.7 HIGH | Siemens SINEC Traffic Analyzer 代码问题漏洞 |
| CVE-2022-40225 | 6.5 MEDIUM | Siemens SIPLUS TIM 1531 IRC 安全漏洞 |
| CVE-2024-35208 | 6.3 MEDIUM | Siemens SINEC Traffic Analyzer 安全漏洞 |
| CVE-2024-35209 | 6.2 MEDIUM | Siemens SINEC Traffic Analyzer 安全漏洞 |
| CVE-2024-35212 | 6.2 MEDIUM | Siemens SINEC Traffic Analyzer 输入验证错误漏洞 |
| CVE-2024-35211 | 5.5 MEDIUM | Siemens SINEC Traffic Analyzer 安全漏洞 |
| CVE-2024-35210 | 5.1 MEDIUM | Siemens SINEC Traffic Analyzer 安全漏洞 |
| CVE-2023-50763 | 4.9 MEDIUM | 多款Siemens产品 安全漏洞 |
| CVE-2023-38533 | 3.3 LOW | Siemens TIA Administrator 安全漏洞 |
IV. Related Vulnerabilities
Same weakness: CWE-269
- CVE-2026-42562
Plainpad: Privilege Escalation via Writable Admin Field in P - CVE-2026-41163
bubblewrap vulnerable to privilege escalation in setuid mode - CVE-2026-44987
SysReptor: Privilege Escalation from User Admin to Superuser - CVE-2026-42185
People: Privilege Escalation via Missing Role Ceiling in Mai - CVE-2026-40001
Local privilege escalation vulnerability in ZTE PROCESS Guar
V. Comments for CVE-2024-33500
No comments yet