CVE-2022-22520mediumCWE-204

CVE-2022-22520: medium-severity vulnerability in MB connect line mymbCONNECT24

User enumeration vulnerability in MB connect line and Helmholz products

Published · Updated

Follow this CVE+ Monitor mbCONNECT24+ Monitor mymbCONNECT24

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 1.0%
In short

An attacker can discover valid usernames by sending specially crafted requests to the web service without needing to log in. This information can be used to launch further attacks like password guessing.

Technical detail

User enumeration vulnerability via information disclosure (CWE-204) in unauthenticated webservice endpoints. Remote attacker can differentiate between valid and invalid usernames through response analysis, enabling targeted credential attacks without prior authentication.

Summary generated and translated by AI from the official description.
A remote, unauthenticated attacker can enumerate valid users by sending specific requests to the webservice of MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
Helmholz · myREX24Helmholz · myREX24.virtualMB connect line · mbCONNECT24MB connect line · mymbCONNECT24
Related CVEs — MB connect line mymbCONNECT24

In the same product, most dangerous first.

CVE-2021-34580HIGHRemote user enumeration in mymbCONNECT24, mbCONNECT24 <= 2.9.0EPSS 1.0%CVE-2020-12527MEDIUMImproper Access Validation in products of MB connect line and HelmholzEPSS 1.0%CVE-2021-34575HIGHInformation Exposure in mymbCONNECT24, mbCONNECT24 <= 2.8.0EPSS 1.0%CVE-2026-14448HIGHAuthenticated RCE in system_certificates viewEPSS 0.9%CVE-2020-12528MEDIUMCVE-2020-12528EPSS 0.9%CVE-2020-12529MEDIUMCVE-2020-12529EPSS 0.8%