CVE-2021-34580: high-severity vulnerability in MB connect line mymbCONNECT24
Remote user enumeration in mymbCONNECT24, mbCONNECT24 <= 2.9.0
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
An attacker can discover valid usernames on mymbCONNECT24 and mbCONNECT24 systems by observing how the server responds to fake login attempts. This helps attackers identify real accounts to target for further attacks.
The application returns different HTTP responses for valid versus invalid usernames during authentication, allowing unauthenticated enumeration via timing or response differentiation attacks. This information disclosure (CWE-204) enables attackers to build a list of legitimate users for subsequent credential-based or brute-force attacks against affected versions up to 2.9.0.
In the same product, most dangerous first.