PT-2021-20556 · Unknown · Mbconnect24+2

Published 2021-08-02 · Updated 2023-02-03 · CVE-2021-34574

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: mymbCONNECT24 versions through 2.11.2 mbCONNECT24 versions through 2.11.2 Helmholz myREX24 versions through 2.11.2 myREX24.virtual versions through 2.11.2

Description: An authenticated attacker can change the password of their account into a new password that violates the password policy by intercepting and modifying the request sent to the server.

Recommendations: For mymbCONNECT24 versions through 2.11.2, consider disabling password change functionality until a patch is available. For mbCONNECT24 versions through 2.11.2, restrict access to password modification features to minimize the risk of exploitation. For Helmholz myREX24 versions through 2.11.2, avoid using the password change feature in the affected API endpoint until the issue is resolved. For myREX24.virtual versions through 2.11.2, as a temporary workaround, consider implementing additional validation on password changes to enforce the password policy.

Fix

Weakness Enumeration

CWE-669

Related Identifiers

CVE-2021-34574

Affected Products

Helmholz Myrex24

Mbconnect24

Myrex24.Virtual

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-34574 · Security Note
• https://osv.dev/vulnerability/CVE-2021-34574 · Vendor Advisory
• https://cert.vde.com/en/advisories/VDE-2022-039 · Note
• https://t.me/cvenotify/36145 · Telegram Post
• https://t.me/cibsecurity/26670 · Telegram Post
• https://cert.vde.com/en/advisories/VDE-2021-030 · Note