PT-2020-15744 · Mb · Mbconnect24

Published 2020-09-29 · Updated 2021-07-21 · CVE-2020-24570

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions mbCONNECT24 versions through 2.6.1 mymbCONNECT24 (affected versions not specified)

Description An issue was discovered that allows attackers to steal session information from logged-in users with a crafted link, due to a CSRF issue with resultant SSRF in the com mb24proxy module.

Recommendations For mbCONNECT24 versions through 2.6.1, update to a version that fixes the CSRF issue in the com mb24proxy module. For mymbCONNECT24, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

CSRF

Weakness Enumeration

CWE-918

CWE-352

Related Identifiers

CVE-2020-24570

Affected Products

Mbconnect24

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-24570 · Security Note
• https://osv.dev/vulnerability/CVE-2020-24570 · Vendor Advisory
• https://mbconnectline.com/security-advice · Vendor Advisory
• https://t.me/true_secator/999 · Telegram Post