CVE-2024-33500

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in Mendix Applications using Mendix 10 (All versions < V10.11.0), Mendix Applications using Mendix 10 (V10.6) (All versions < V10.6.9), Mendix Applications using Mendix 9 (All versions >= V9.3.0 < V9.24.22). Affected applications could allow users with the capability to manage a role to elevate the access rights of users with that role. Successful exploitation requires to guess the id of a target role which contains the elevated access rights.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
Siemens	Mendix Applications using Mendix 10	< V10.11.0
Siemens	Mendix Applications using Mendix 10 (V10.6)	< V10.6.9
Siemens	Mendix Applications using Mendix 9	>= V9.3.0, < V9.24.22
siemens	mendix	>= 10..0, < 10.11.0; >= 10.6, < 10.6.9; >= 9.3.0, < 9.24.22

References

Timeline

Published: Jun 11, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-335016.7Two improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in Fortinet FortiAnalyzer ve CVE-2024-335027.2An improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiManager, FortiAnalyzer versions 7.4.0 thr CVE-2024-335037.8A improper privilege management vulnerability in Fortinet FortiManager Cloud 7.4.1 through 7.4.3, FortiManager Cloud 7.2.1 through 7.2.5, Fo CVE-2024-335047.7A use of hard-coded cryptographic key to encrypt sensitive data vulnerability [CWE-321] in FortiManager 7.6.0 through 7.6.1, 7.4.0 through 7 CVE-2024-335057.3A heap-based buffer overflow in Fortinet FortiAnalyzer version 7.4.0 through 7.4.2, 7.2.0 through 7.2.5, 7.0.0 through 7.0.12, 6.4.0 through CVE-2024-335064.3An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiManager 7.4.2 and below, 7.2.5 and below, 7.0.CVE-2024-335079.1An insufficient session expiration vulnerability [CWE-613] and an incorrect authorization vulnerability [CWE-863] in FortiIsolator 2.4.0 thr CVE-2024-335087.3An improper neutralization of special elements used in a command ('Command Injection') vulnerability [CWE-77] in Fortinet FortiClientEMS 7.2 CVE-2024-335094.8An improper certificate validation vulnerability [CWE-295] in FortiWeb 7.2.0 through 7.2.1, 7.0 all versions, 6.4 all versions and 6.3 all v CVE-2024-33519.8A vulnerability, which was classified as critical, was found in SourceCodester Aplaya Beach Resort Online Reservation System 1.0. This affec CVE-2024-335104.3An improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability [CWE-74] in FortiOS vers CVE-2024-335119.8There is a buffer overflow vulnerability in the underlying Automatic Reporting service that could lead to unauthenticated remote code execut