CVE-2023-0985highCWE-639

CVE-2023-0985: falha de alta gravidade em mbCONNECT24

Helmholz and MB Connect Line: Account takeover via password reset in multiple products

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar mbCONNECT24+ Monitorar mymbCONNECT24

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.8epss 0.8%
An Authorization Bypass vulnerability was found in MB Connect Lines mbCONNECT24, mymbCONNECT24 and Helmholz' myREX24 and myREX24.virtual version <= 2.13.3. An authenticated remote user with low privileges can change the password of any user in the same account. This allows to take over the admin user and therefore fully compromise the account.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Helmholz · myREX24Helmholz · myREX24.virtualMB Connect Line · mbCONNECT24MB Connect Line · mymbCONNECT24
CVEs relacionadas — mbCONNECT24

No mesmo produto, das mais perigosas para as menos.

CVE-2020-12527MEDIUMImproper Access Validation in products of MB connect line and HelmholzEPSS 1.0%CVE-2022-22520MEDIUMUser enumeration vulnerability in MB connect line and Helmholz productsEPSS 1.0%CVE-2021-34574MEDIUMPassword policy evasion in products of MB connect line and HelmholzEPSS 0.7%CVE-2024-45272HIGHMB connect line/Helmholz: Generation of weak passwords vulnerabilityEPSS 0.6%CVE-2023-1779MEDIUMHelmholz and MB Connect Line: Account takeover via password reset in multiple productsEPSS 0.5%CVE-2025-3092HIGHMB connect line: Observable response discrepancy in mbCONNECT24/mymbCONNECT24EPSS 0.5%