PT-2020-12051 · Mb Connect Line · Mbconnect24+1

Published 2020-04-14 · Updated 2022-10-07 · CVE-2020-10381

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions mbCONNECT24 versions through 2.5.0 mymbCONNECT24 versions through 2.5.0

Description An issue was discovered in the MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 software, allowing for an unauthenticated SQL injection in DATA24. This enables attackers to discover database and table names.

Recommendations For mbCONNECT24 versions through 2.5.0, update to a version later than 2.5.0 to resolve the issue. For mymbCONNECT24 versions through 2.5.0, update to a version later than 2.5.0 to resolve the issue. As a temporary workaround, consider restricting access to the DATA24 component to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-10381

Affected Products

Data24

Mbconnect24

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-10381 · Security Note
• https://osv.dev/vulnerability/CVE-2020-10381 · Vendor Advisory
• https://mbconnectline.com/security-advice · Vendor Advisory
• https://t.me/cibsecurity/11227 · Telegram Post