{"id":"CVE-2021-33712","aliases":["EUVD-2021-20389","GHSA-5xc3-hrwr-2p8h"],"status":"published","title":"A vulnerability has been identified in Mendix SAML Module (All versions \u003c V2.1.2). The...","description":"A vulnerability has been identified in Mendix SAML Module (All versions \u003c V2.1.2). The configuration of the SAML module does not properly check various restrictions and validations imposed by an identity provider. This could allow a remote authenticated attacker to escalate privileges.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00604,"percentile":0.49202,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-345"],"published":"2021-06-08T19:47:17Z","modified":"2026-06-17T03:55:05Z","products":[{"vendor":"mendix","product":"saml"},{"vendor":"siemens","product":"mendix saml module"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-522654.pdf","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33712"},{"url":"https://github.com/advisories/GHSA-5xc3-hrwr-2p8h"}],"sources":{"cve":[{"id":"CVE-2021-33712","description":"A vulnerability has been identified in Mendix SAML Module (All versions \u003c V2.1.2). The configuration of the SAML module does not properly check various restrictions and validations imposed by an identity provider. This could allow a remote authenticated attacker to escalate privileges.","status":"published","published":"2021-06-08T19:47:17Z","modified":"2024-08-03T23:58:22.801Z","cwes":["CWE-345"],"updated_at":"2026-11-02T14:33:10.204494Z"}],"euvd":[{"id":"EUVD-2021-20389","description":"A vulnerability has been identified in Mendix SAML Module (All versions \u003c V2.1.2). The configuration of the SAML module does not properly check various restrictions and validations imposed by an identity provider. This could allow a remote authenticated attacker to escalate privileges.","status":"published","published":"2021-06-08T19:47:17Z","modified":"2024-08-03T23:58:22Z","updated_at":"2026-11-03T03:24:33.866739Z"}],"ghsa":[{"id":"GHSA-5xc3-hrwr-2p8h","title":"A vulnerability has been identified in Mendix SAML Module (All versions \u003c V2.1.2). The...","description":"A vulnerability has been identified in Mendix SAML Module (All versions \u003c V2.1.2). The configuration of the SAML module does not properly check various restrictions and validations imposed by an identity provider. This could allow a remote authenticated attacker to escalate privileges.","status":"published","published":"2022-05-24T19:04:17Z","modified":"2023-01-29T05:06:54Z","cwes":["CWE-345"],"updated_at":"2026-11-02T14:46:07.317218Z"}],"nvd":[{"id":"CVE-2021-33712","description":"A vulnerability has been identified in Mendix SAML Module (All versions \u003c V2.1.2). The configuration of the SAML module does not properly check various restrictions and validations imposed by an identity provider. This could allow a remote authenticated attacker to escalate privileges.","status":"published","published":"2021-06-08T20:15:09.093Z","modified":"2026-06-17T03:55:05.383Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T14:06:54.439974Z"}]}}