CVE Vulnerability

CVE-2022-22520

A remote, unauthenticated attacker can enumerate valid users by sending specific requests to the webservice of MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2.

5.3 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://cert.vde.com/en/advisories/VDE-2022-039 Not Applicable
https://cert.vde.com/en/advisories/VDE-2022-011 Third Party Advisory VDB Entry
Configurations

Configuration 1

cpe:2.3:a:mbconnectline:mbconnect24:*:*:*:*:*:*:*:*
cpe:2.3:a:mbconnectline:mymbconnect24:*:*:*:*:*:*:*:*
cpe:2.3:a:helmholz:myrex24.virtual:*:*:*:*:*:*:*:*
cpe:2.3:a:helmholz:myrex24:*:*:*:*:*:*:*:*
Information

Published : 2022-09-14 02:15

Updated : 2022-10-01 02:33

NVD link : CVE-2022-22520

Mitre link : CVE-2022-22520

Products Affected
No products.
CWE
CWE-204

Observable Response Discrepancy