CVE-2020-35568 - Sensitive Information Exposure in products of MB connect line and Helmholz

Back Back to CVE browser

MEDIUM

Sensitive Information Exposure in products of MB connect line and Helmholz

Published Feb 16, 2021

4.3

MEDIUM

CVSS 3.1

EPSS 0.97%

Description

An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. An incomplete filter applied to a database response allows an authenticated attacker to gain non-public information about other users and devices in the account.

Affected products

Remediation

Vendor solution

Update to 2.12.1

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (4)

https://cert.vde.com/en/advisories/VDE-2021-003
x_refsource_CONFIRMThird Party Advisory
https://cert.vde.com/en/advisories/VDE-2022-039
x_refsource_CONFIRMThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-23235
Advisory
https://mbconnectline.com/security-advice/
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://cert.vde.com/en/advisories/VDE-2021-003		x_refsource_CONFIRMThird Party Advisory
https://cert.vde.com/en/advisories/VDE-2022-039		x_refsource_CONFIRMThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-23235		Advisory
https://mbconnectline.com/security-advice/		x_refsource_MISCVendor Advisory