PT-2021-20294 · Mendix · Mendix 7+2

Published 2021-07-13 · Updated 2021-07-27 · CVE-2021-33718

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Mendix Applications using Mendix 7 versions prior to 7.23.22 Mendix Applications using Mendix 8 versions prior to 8.18.7 Mendix Applications using Mendix 9 versions prior to 9.3.0

Description: A security issue has been found that allows write access checks of attributes of an object to be bypassed if a user has write permissions to the first attribute of the object.

Recommendations: For Mendix 7, update to version 7.23.22 or later to resolve the issue. For Mendix 8, update to version 8.18.7 or later to resolve the issue. For Mendix 9, update to version 9.3.0 or later to resolve the issue.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2021-33718

Affected Products

Mendix 7

Mendix 8

Mendix 9

References · 3

• https://osv.dev/vulnerability/CVE-2021-33718 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33718 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-352521.pdf · Vendor Advisory