CVE-2021-34575 Information Exposure in mymbCONNECT24, mbCONNECT24 <= 2.8.0
Unauthenticated attackers can enumerate valid users by analyzing server responses, exposing user account information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-34575?
CVE-2021-34575 is a high-severity vulnerability in mbCONNECT24, published on 2 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In MB connect line mymbCONNECT24, mbCONNECT24 in versions <= 2.8.0 an unauthenticated user can enumerate valid users by checking what kind of response the server sends.
Weakness: CWE-203
Which versions are affected by CVE-2021-34575?
It affects 2 products.
Products include Mbconnectline Mbconnect24, Mbconnectline Mymbconnect24.
How do I fix CVE-2021-34575?
No fix has been published for CVE-2021-34575 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-34575 being exploited?
There is no known exploitation of CVE-2021-34575 in the wild and no public exploit code.
Other vulnerabilities in mbCONNECT24
- CVE-2020-35565 Security feature bypass in n/a
- CVE-2020-10383 Code injection in n/a
- CVE-2026-33615 MB connect line mbCONNECT24 vulnerable to an unauthenticated SQL injection in the setinfo Endpoint
- CVE-2023-0985 Helmholz and MB Connect Line: Account takeover via password reset in multiple products
- CVE-2020-10382 Code injection in n/a
Sources
Also known as GHSA-643m-j2p7-phvx.