PT-2021-10875 · Dconnect · Connect

Published 2021-07-21 · Updated 2021-08-02 · CVE-2020-23283

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions mConnect application version v02.001.00

Description The issue allows an attacker to discover valid users from the application's database through brute force. This is due to information disclosure in the Logon Page of the mConnect application.

Recommendations For version v02.001.00, consider temporarily restricting access to the Logon Page until a fix is available. As a mitigation measure, restrict brute force attempts on the login functionality to minimize the risk of exploitation.

Exploit

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2020-23283

Affected Products

Connect

References · 5

• 🔥 https://linkedin.com/pulse/descobrindo-usu%C3%A1rios-brute-force-iran · Exploit
• https://osv.dev/vulnerability/CVE-2020-23283 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-23283 · Security Note
• https://t.me/cibsecurity/26335 · Telegram Post
• https://github.com/ifmacedo/mconnect/blob/main/bruteforce · Note