CVE-2020-35566
Local file inclusion vulnerability in products of MB connect line and Helmholz
Severity Score
5.3
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. An attacker can read arbitrary JSON files via Local File Inclusion.
Se detectó un problema en la línea de conexión MB mymbCONNECT24, mbCONNECT24 y Helmholz myREX24 y myREX24.virtual en todas las versiones hasta la v2.11.2. Un atacante puede leer archivos JSON arbitrarios a través de la inclusión de archivos locales.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2020-12-18 CVE Reserved
- 2021-02-16 CVE Published
- 2024-09-16 CVE Updated
- 2024-09-17 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-706: Use of Incorrectly-Resolved Name or Reference
CAPEC
References (3)
| URL | Tag | Source |
|---|---|---|
| https://cert.vde.com/en/advisories/VDE-2021-003 | Third Party Advisory | |
| https://cert.vde.com/en/advisories/VDE-2022-039 | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://mbconnectline.com/security-advice | 2023-02-16 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Mbconnectline Search vendor "Mbconnectline" | Mbconnect24 Search vendor "Mbconnectline" for product "Mbconnect24" | <= 2.11.2 Search vendor "Mbconnectline" for product "Mbconnect24" and version " <= 2.11.2" | - |
Affected
| ||||||
| Mbconnectline Search vendor "Mbconnectline" | Mymbconnect24 Search vendor "Mbconnectline" for product "Mymbconnect24" | <= 2.11.2 Search vendor "Mbconnectline" for product "Mymbconnect24" and version " <= 2.11.2" | - |
Affected
| ||||||
| Helmholz Search vendor "Helmholz" | Myrex24 Search vendor "Helmholz" for product "Myrex24" | <= 2.11.2 Search vendor "Helmholz" for product "Myrex24" and version " <= 2.11.2" | - |
Affected
| ||||||
| Helmholz Search vendor "Helmholz" | Myrex24.virtual Search vendor "Helmholz" for product "Myrex24.virtual" | <= 2.11.2 Search vendor "Helmholz" for product "Myrex24.virtual" and version " <= 2.11.2" | - |
Affected
| ||||||