« Volver al listado

CVE-2021-27394

Estado: ModificadaAlta (8.8)—

A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.19), Mendix Applications using Mendix 8 (All versions < V8.17.0), Mendix Applications using Mendix 8 (V8.12) (All versions < V8.12.5), Mendix Applications using Mendix 8 (V8.6) (All versions < V8.6.9), Mendix Applications using Mendix 9 (All versions < V9.0.5). Authenticated, non-administrative users could modify their privileges by manipulating the user role under certain circumstances, allowing them to gain administrative privileges.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mendix — Mendix

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-27394",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "productcert@siemens.com",
      "affectedData": [
        {
          "vendor": "Siemens",
          "product": "Mendix Applications using Mendix 7",
          "versions": [
            {
              "status": "affected",
              "version": "All versions < V7.23.19"
            }
          ]
        },
        {
          "vendor": "Siemens",
          "product": "Mendix Applications using Mendix 8",
          "versions": [
            {
              "status": "affected",
              "version": "All versions < V8.17.0"
            }
          ]
        },
        {
          "vendor": "Siemens",
          "product": "Mendix Applications using Mendix 8 (V8.12)",
          "versions": [
            {
              "status": "affected",
              "version": "All versions < V8.12.5"
            }
          ]
        },
        {
          "vendor": "Siemens",
          "product": "Mendix Applications using Mendix 8 (V8.6)",
          "versions": [
            {
              "status": "affected",
              "version": "All versions < V8.6.9"
            }
          ]
        },
        {
          "vendor": "Siemens",
          "product": "Mendix Applications using Mendix 9",
          "versions": [
            {
              "status": "affected",
              "version": "All versions < V9.0.5"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-04-16T20:15:12.387",
  "references": [
    {
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-875726.pdf",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "productcert@siemens.com"
    },
    {
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-875726.pdf",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "productcert@siemens.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.19), Mendix Applications using Mendix 8 (All versions < V8.17.0), Mendix Applications using Mendix 8 (V8.12) (All versions < V8.12.5), Mendix Applications using Mendix 8 (V8.6) (All versions < V8.6.9), Mendix Applications using Mendix 9 (All versions < V9.0.5). Authenticated, non-administrative users could modify their privileges by manipulating the user role under certain circumstances, allowing them to gain administrative privileges."
    },
    {
      "lang": "es",
      "value": "Se ha identificado una vulnerabilidad en Mendix Applications usando Mendix 7 (todas las versiones anteriores a V7.23.19), Mendix Applications usando Mendix 8 (todas las versiones anteriores a V8.17.0), Mendix Applications usando Mendix 8 (V8.12) (todas las versiones anteriores a V8. 12.5), Mendix Applications usando Mendix 8 (V8.6) (Todas las versiones anteriores a V8.6.9), Mendix Applications usando Mendix 9 (Todas las versiones anteriores a V9.0.5).&#xa0;Los usuarios no administrativos autenticados pueden modificar sus privilegios al manipular la función del usuario en determinadas circunstancias, permitiéndoles alcanzar privilegios administrativos"
    }
  ],
  "lastModified": "2026-06-17T03:44:46.740",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mendix:mendix:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "46727C96-E577-40DC-9CB7-84B1F9FE2761",
              "versionEndExcluding": "7.23.19",
              "versionStartIncluding": "7.0.2"
            },
            {
              "criteria": "cpe:2.3:a:mendix:mendix:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "619470AA-8464-4830-8EEF-0F3A19136A3D",
              "versionEndExcluding": "8.17.0",
              "versionStartIncluding": "8.0.0"
            },
            {
              "criteria": "cpe:2.3:a:mendix:mendix:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1454FE73-9896-48DF-92C7-7B64F0F200E6",
              "versionEndExcluding": "9.0.5",
              "versionStartIncluding": "9.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mendix:mendix:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F0774932-F62C-413A-878C-A346609D5CBF",
              "versionEndExcluding": "8.6.9",
              "versionStartIncluding": "8.6.0"
            },
            {
              "criteria": "cpe:2.3:a:mendix:mendix:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DA73E222-A316-4EA9-8C25-DAB0D63182A7",
              "versionEndExcluding": "8.12.5",
              "versionStartIncluding": "8.12.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "productcert@siemens.com"
}