PT-2021-11796 · Unknown · Mbconnect24

Published 2021-02-16 · Updated 2021-02-19 · CVE-2020-35565

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: mbCONNECT24 versions through 2.6.2 mymbCONNECT24 versions through 2.6.2

Description: An issue was discovered where the login pages' bruteforce detection is disabled by default.

Recommendations: For mbCONNECT24 versions through 2.6.2, enable the bruteforce detection on the login pages. For mymbCONNECT24 versions through 2.6.2, enable the bruteforce detection on the login pages.

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2020-35565

Affected Products

Mbconnect24

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-35565 · Security Note
• https://osv.dev/vulnerability/CVE-2020-35565 · Vendor Advisory
• https://mbconnectline.com/security-advice · Vendor Advisory
• https://cert.vde.com/de-de/advisories/vde-2021-003 · Note
• https://t.me/cibsecurity/23640 · Telegram Post