Share: Email | Twitter

ID

VDE-2021-037

Published

2021-10-27 12:15 (CEST)

Last update

2021-10-27 12:15 (CEST)

Vendor(s)

MB connect line GmbH

Product(s)

Article No° Product Name Affected Version(s)
mbCONNECT24 <= 2.9.0
mymbCONNECT24 <= 2.9.0

Summary

An issue was discovered in the mymbCONNECT24 and mbCONNECT24 software in all versions through V2.9.0.

CVE ID

CVE-2021-34580 

Last Update:

Nov. 3, 2021, 3:07 p.m.

Severity

7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) 

Weakness

Response Discrepancy Information Exposure  (CWE-204) 

Summary

An unauthenticated user can enumerate valid backend users by checking what kind of response the server sends for crafted invalid login attempts.

Details

nvd.nist.gov 

Impact

Please consult the CVE Entry above.

Solution

Update mbCONNECT24/mymbCONNECT24 to 2.10.1

Reported by

LEWA Attendorn GmbH reported this vulnerability to MB connect line.

CERT@VDE coordinated.