CVEvulnerability

CVE-2022-22520

5.3 MEDIUM Published 2022-09-14 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-09-14
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-204

Description

A remote, unauthenticated attacker can enumerate valid users by sending specific requests to the webservice of MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2.

Affected configurations

• mbconnectline mbconnect24 (<= 2.11.2) • mbconnectline mymbconnect24 (<= 2.11.2) • helmholz myrex24 (<= 2.11.2) • helmholz myrex24.virtual (<= 2.11.2)

Related

Weakness · CWE (1)

  • CWE-204 Observable Response Discrepancy weakness

References