CVE-2022-22520
User enumeration vulnerability in MB connect line and Helmholz products
In short
An attacker can discover valid usernames by sending specially crafted requests to the web service without needing to log in. This information can be used to launch further attacks like password guessing.
Technical detail
User enumeration vulnerability via information disclosure (CWE-204) in unauthenticated webservice endpoints. Remote attacker can differentiate between valid and invalid usernames through response analysis, enabling targeted credential attacks without prior authentication.
Summary generated and translated by AI from the official description.
A remote, unauthenticated attacker can enumerate valid users by sending specific requests to the webservice of MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
Helmholz · myREX24Helmholz · myREX24.virtualMB connect line · mbCONNECT24MB connect line · mymbCONNECT24Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →