Skip to content
OpenAdvisories
Medium VDE-2022-011 1 CVE

MB connect line: Unauthenticated user enumeration in mbCONNECT24 and mymbCONNECT24

Published Sep 7, 2022 · Updated Sep 7, 2022

Vendor: MB connect line Product: mbCONNECT24 Product: mymbCONNECT24

Summary

An issue was discovered in the mymbCONNECT24 and mbCONNECT24 software in all versions through V2.11.2.

Details

Impact
A remote, unauthenticated attacker can enumerate valid users with a timing attack against the webserver.

Remediation
Update to Version 2.12.1

Vulnerabilities 1

  • Medium 5.3
    CVE-2022-22520

    User enumeration vulnerability in MB connect line and Helmholz products

    A remote, unauthenticated attacker can enumerate valid users by sending specific requests to the webservice of MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2.

    MB connect line Helmholz mymbCONNECT24 mbCONNECT24

Revision history

  1. #1

    initial revision

References