PT-2021-20557 · Unknown · Mbconnect24

Published 2021-08-02 · Updated 2021-08-10 · CVE-2021-34575

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: mbCONNECT24 versions <= 2.8.0

Description: The issue allows an unauthenticated user to enumerate valid users by analyzing the server's response. This can be done by checking the kind of response the server sends, potentially revealing sensitive information about the system's users.

Recommendations: For versions <= 2.8.0, update to a version greater than 2.8.0 to resolve the issue. As a temporary workaround, consider restricting access to the server to minimize the risk of user enumeration.

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CVE-2021-34575

Affected Products

Mbconnect24

References · 4

• https://osv.dev/vulnerability/CVE-2021-34575 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-34575 · Security Note
• https://cert.vde.com/de-de/advisories/vde-2021-030 · Note
• https://t.me/cibsecurity/26659 · Telegram Post