CVE-2020-35570
Foreced Browsing vulnerability in products of MB connect line and Helmholz
Severity Score
5.3
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual through 2.11.2. An unauthenticated attacker is able to access files (that should have been restricted) via forceful browsing.
Se detectó un problema en la línea de conexión MB mymbCONNECT24, mbCONNECT24 y Helmholz myREX24 y myREX24.virtual hasta la versión 2.11.2. Un atacante no autenticado es capaz de acceder a archivos (que deberían haber sido restringidos) a través de la navegación forzada.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2020-12-18 CVE Reserved
- 2021-02-16 CVE Published
- 2024-09-16 CVE Updated
- 2024-09-17 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-425: Direct Request ('Forced Browsing')
CAPEC
References (3)
| URL | Tag | Source |
|---|---|---|
| https://cert.vde.com/en/advisories/VDE-2021-003 | Third Party Advisory | |
| https://cert.vde.com/en/advisories/VDE-2022-039 | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://mbconnectline.com/security-advice | 2023-02-16 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Mbconnectline Search vendor "Mbconnectline" | Mbconnect24 Search vendor "Mbconnectline" for product "Mbconnect24" | <= 2.11.2 Search vendor "Mbconnectline" for product "Mbconnect24" and version " <= 2.11.2" | - |
Affected
| ||||||
| Mbconnectline Search vendor "Mbconnectline" | Mymbconnect24 Search vendor "Mbconnectline" for product "Mymbconnect24" | <= 2.11.2 Search vendor "Mbconnectline" for product "Mymbconnect24" and version " <= 2.11.2" | - |
Affected
| ||||||
| Helmholz Search vendor "Helmholz" | Myrex24 Search vendor "Helmholz" for product "Myrex24" | <= 2.11.2 Search vendor "Helmholz" for product "Myrex24" and version " <= 2.11.2" | - |
Affected
| ||||||
| Helmholz Search vendor "Helmholz" | Myrex24.virtual Search vendor "Helmholz" for product "Myrex24.virtual" | <= 2.11.2 Search vendor "Helmholz" for product "Myrex24.virtual" and version " <= 2.11.2" | - |
Affected
| ||||||