PT-2021-11798 · Unknown · Mbconnect24

Published 2021-02-16 · Updated 2021-02-19 · CVE-2020-35567

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: mbCONNECT24 versions through 2.6.2 mymbCONNECT24 versions through 2.6.2

Description: The software uses a secure password for database access, but this password is shared across instances.

Recommendations: For mbCONNECT24 versions through 2.6.2, consider changing the shared database access password to unique passwords for each instance. For mymbCONNECT24 versions through 2.6.2, consider changing the shared database access password to unique passwords for each instance.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2020-35567

Affected Products

Mbconnect24

References · 5

• https://osv.dev/vulnerability/CVE-2020-35567 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-35567 · Security Note
• https://mbconnectline.com/security-advice · Vendor Advisory
• https://cert.vde.com/de-de/advisories/vde-2021-003 · Note
• https://t.me/cibsecurity/23639 · Telegram Post