PT-2021-11790 · Mb Connect Line+1 · Mbconnect24+2

Published 2021-02-16 · Updated 2023-02-16 · CVE-2020-35558

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: MB connect line mymbCONNECT24 versions 2.6.2 through 2.11.2 mbCONNECT24 versions 2.6.2 through 2.11.2 Helmholz myREX24 versions 2.6.2 through 2.11.2 Helmholz myREX24.virtual versions 2.6.2 through 2.11.2

Description: An issue was discovered in the MySQL access check, allowing an attacker to perform a Server-Side Request Forgery (SSRF) attack. This enables the attacker to scan for open ports and gain some information about possible credentials.

Recommendations: For MB connect line mymbCONNECT24 versions 2.6.2 through 2.11.2, consider disabling the MySQL access check feature until a patch is available. For mbCONNECT24 versions 2.6.2 through 2.11.2, restrict access to the MySQL access check to minimize the risk of exploitation. For Helmholz myREX24 and myREX24.virtual versions 2.6.2 through 2.11.2, avoid using the MySQL access check feature in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2020-35558

Affected Products

Mbconnect24

Myrex24

Myrex24.Virtual

References · 8

• https://osv.dev/vulnerability/CVE-2020-35558 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-35558 · Security Note
• https://mbconnectline.com/security-advice · Vendor Advisory
• https://cert.vde.com/en/advisories/VDE-2021-003 · Note
• https://t.me/cvenotify/44440 · Telegram Post
• https://t.me/cvenotify/9986 · Telegram Post
• https://cert.vde.com/en/advisories/VDE-2022-039 · Note
• https://t.me/cibsecurity/23655 · Telegram Post