User enumeration vulnerability in MB connect line and Helmholz products
CVE-2022-22520

5.3MEDIUM

Key Information:

Vendor

Mb Connect Line

Status
Mymbconnect24
Mbconnect24
Myrex24
Myrex24.virtual
Vendor
CVE Published:
7 September 2022

What is CVE-2022-22520?

A remote, unauthenticated attacker can enumerate valid users by sending specific requests to the webservice of MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2.

Affected Version(s)

mbCONNECT24 2 <= 2.11.2

mymbCONNECT24 2 <= 2.11.2

myREX24 2 <= 2.11.2

References

https://cert.vde.com/en/advisories/VDE-2022-039
x_refsource_CONFIRM
https://cert.vde.com/en/advisories/VDE-2022-011
x_refsource_CONFIRM

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

SySS GmbH reported this vulnerability to Helmholz. Helmholz reported this vulnerability to MB connect line. CERT@VDE coordinated with Helmholz & MB connect line.
.
CVE-2022-22520 : User enumeration vulnerability in MB connect line and Helmholz products