CVE-2023-1779 — Helmholz and MB Connect Line: Account takeover via password reset in multiple products

CVE-2023-1779

Helmholz and MB Connect Line: Account takeover via password reset in multiple products PUBLISHED

Description (CNA)

Exposure of Sensitive Information to an unauthorized actor vulnerability in MB Connect Lines mbCONNECT24, mymbCONNECT24 and Helmholz' myREX24 and myREX24.virtual in versions <=2.13.3 allow an authorized remote attacker with low privileges to view a limited amount of another accounts contact information.

Affected (CNA)

Vendor / product	Versions
MB Connect Line / mbCONNECT24	affected 1.0.0 through 2.13.3
MB Connect Line / mymbCONNECT24	affected 1.0.0 through 2.13.3
Helmholz / myREX24	affected 0 through 2.13.3
Helmholz / myREX24.virtual	affected 0 through 2.13.3

CWE

CWE-863

References

https://cert.vde.com/en/advisories/VDE-2023-008/

ADP enrichment

CVE

No English description supplied.

https://cert.vde.com/en/advisories/VDE-2023-008/

CISA-ADP

No English description supplied.

No references supplied.