CVE-2024-33500: Mendix Runtime Privilege Escalation via Improper Access Control

Key Information Summary Vulnerability Overview Vulnerability ID: CVE-2024-33500 Vulnerability Title: SSA-540640: Permission Management Vulnerability in Mendix Runtime Release Date: 2024-06-11 Current Version: V1.0 CVSS Rating: - v3.1 Base Score: 5.9 - v4.0 Base Score: 7.4 Affected Products and Versions Affected Products and Versions: - Mendix Applications using Mendix 9: V9.3.0 <= version < V9.24.22 - Mendix Applications using Mendix 10: version < V10.11.0 Remediation Recommendation: Upgrade to the recommended version or later, see related links for details Mitigation Measures and Security Recommendations Operation Principle and Mitigation: Set the runtime configuration to , but this reduces the security of reference checks General Security Recommendations: Implement network access controls and configure the environment according to Siemens Industrial Security Guidelines Vulnerability Description Vulnerability Details: Due to improper permission management, affected applications may allow users with administrative role capabilities to elevate permissions for other users. Successful exploitation requires guessing the ID of the role that includes the elevated permissions. CVSS Rating Details: - v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N - v4.0 Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CWE ID: CWE-269: Improper Privilege Management Acknowledgments Thank you to the Achmea Security Assessment Team for reporting this vulnerability

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2024-33500: Mendix Runtime Privilege Escalation via Improper Access Control