CVE-2021-34574
Password policy evasion in products of MB connect line and Helmholz
Severity Score
4.3
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
In MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2 an authenticated attacker can change the password of his account into a new password that violates the password policy by intercepting and modifying the request that is send to the server.
En MB connect line mymbCONNECT24, mbCONNECT24 y Helmholz myREX24 y myREX24.virtual en todas las versiones hasta la v2.11.2 un atacante autenticado puede cambiar la contraseña de su cuenta por una nueva que viole la política de contraseñas interceptando y modificando la petición que se envía al servidor.
*Credits:
OTORIO reported the vulnerabilities to MB connect line.
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2021-06-10 CVE Reserved
- 2021-08-02 CVE Published
- 2024-03-30 EPSS Updated
- 2024-09-16 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-669: Incorrect Resource Transfer Between Spheres
CAPEC
References (2)
| URL | Tag | Source |
|---|---|---|
| https://cert.vde.com/en/advisories/VDE-2021-030 | Third Party Advisory | |
| https://cert.vde.com/en/advisories/VDE-2022-039 | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Mbconnectline Search vendor "Mbconnectline" | Mbconnect24 Search vendor "Mbconnectline" for product "Mbconnect24" | <= 2.11.2 Search vendor "Mbconnectline" for product "Mbconnect24" and version " <= 2.11.2" | - |
Affected
| ||||||
| Mbconnectline Search vendor "Mbconnectline" | Mymbconnect24 Search vendor "Mbconnectline" for product "Mymbconnect24" | <= 2.11.2 Search vendor "Mbconnectline" for product "Mymbconnect24" and version " <= 2.11.2" | - |
Affected
| ||||||
| Helmholz Search vendor "Helmholz" | Myrex24 Search vendor "Helmholz" for product "Myrex24" | <= 2.11.2 Search vendor "Helmholz" for product "Myrex24" and version " <= 2.11.2" | - |
Affected
| ||||||
| Helmholz Search vendor "Helmholz" | Myrex24.virtual Search vendor "Helmholz" for product "Myrex24.virtual" | <= 2.11.2 Search vendor "Helmholz" for product "Myrex24.virtual" and version " <= 2.11.2" | - |
Affected
| ||||||