CVE-2022-22520 - OpenCVE

A remote, unauthenticated attacker can enumerate valid users by sending specific requests to the webservice of MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Helmholz	Myrex24 Myrex24.virtual
Mbconnectline	Mbconnect24 Mymbconnect24

Configuration 1 [-]

OR	cpe:2.3:a:mbconnectline:mbconnect24::::::::
	cpe:2.3:a:mbconnectline:mymbconnect24::::::::

Configuration 2 [-]

OR	cpe:2.3:a:helmholz:myrex24::::::::
	cpe:2.3:a:helmholz:myrex24.virtual::::::::

No data.

References

Link	Providers
https://cert.vde.com/en/advisories/VDE-2022-011
https://cert.vde.com/en/advisories/VDE-2022-039

History

No history.

MITRE

Status: PUBLISHED

Assigner: CERTVDE

Published: 2022-09-14T14:05:30.024889Z

Updated: 2024-09-17T04:14:21.926Z

Reserved: 2022-01-03T00:00:00

Link: CVE-2022-22520

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2022-09-14T14:15:12.427

Modified: 2022-10-01T02:33:08.290

Link: CVE-2022-22520

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "mymbCONNECT24", "vendor": "MB connect line", "versions": [{"lessThanOrEqual": "2.11.2", "status": "affected", "version": "2", "versionType": "custom"}]}, {"product": "mbCONNECT24", "vendor": "MB connect line", "versions": [{"lessThanOrEqual": "2.11.2", "status": "affected", "version": "2", "versionType": "custom"}]}, {"product": "myREX24", "vendor": "Helmholz", "versions": [{"lessThanOrEqual": "2.11.2", "status": "affected", "version": "2", "versionType": "custom"}]}, {"product": "myREX24.virtual", "vendor": "Helmholz", "versions": [{"lessThanOrEqual": "2.11.2", "status": "affected", "version": "2", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "SySS GmbH reported this vulnerability to Helmholz. Helmholz reported this vulnerability to MB connect line. CERT@VDE coordinated with Helmholz & MB connect line."}], "datePublic": "2022-09-07T00:00:00", "descriptions": [{"lang": "en", "value": "A remote, unauthenticated attacker can enumerate valid users by sending specific requests to the webservice of MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-204", "description": "CWE-204 Response Discrepancy Information Exposure", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-09-14T14:05:29", "orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://cert.vde.com/en/advisories/VDE-2022-039"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://cert.vde.com/en/advisories/VDE-2022-011"}], "solutions": [{"lang": "en", "value": "Update to Version 2.12.1"}], "source": {"advisory": "VDE-2022-011", "discovery": "EXTERNAL"}, "title": "User enumeration vulnerability in MB connect line and Helmholz products", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "info@cert.vde.com", "DATE_PUBLIC": "2022-09-07T10:00:00.000Z", "ID": "CVE-2022-22520", "STATE": "PUBLIC", "TITLE": "User enumeration vulnerability in MB connect line and Helmholz products"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "mymbCONNECT24", "version": {"version_data": [{"version_affected": "<=", "version_name": "2", "version_value": "2.11.2"}]}}, {"product_name": "mbCONNECT24", "version": {"version_data": [{"version_affected": "<=", "version_name": "2", "version_value": "2.11.2"}]}}]}, "vendor_name": "MB connect line"}, {"product": {"product_data": [{"product_name": "myREX24", "version": {"version_data": [{"version_affected": "<=", "version_name": "2", "version_value": "2.11.2"}]}}, {"product_name": "myREX24.virtual", "version": {"version_data": [{"version_affected": "<=", "version_name": "2", "version_value": "2.11.2"}]}}]}, "vendor_name": "Helmholz"}]}}, "credit": [{"lang": "eng", "value": "SySS GmbH reported this vulnerability to Helmholz. Helmholz reported this vulnerability to MB connect line. CERT@VDE coordinated with Helmholz & MB connect line."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A remote, unauthenticated attacker can enumerate valid users by sending specific requests to the webservice of MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-204 Response Discrepancy Information Exposure"}]}]}, "references": {"reference_data": [{"name": "https://cert.vde.com/en/advisories/VDE-2022-039", "refsource": "CONFIRM", "url": "https://cert.vde.com/en/advisories/VDE-2022-039"}, {"name": "https://cert.vde.com/en/advisories/VDE-2022-011", "refsource": "CONFIRM", "url": "https://cert.vde.com/en/advisories/VDE-2022-011"}]}, "solution": [{"lang": "en", "value": "Update to Version 2.12.1"}], "source": {"advisory": "VDE-2022-011", "discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T03:14:55.402Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://cert.vde.com/en/advisories/VDE-2022-039"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://cert.vde.com/en/advisories/VDE-2022-011"}]}]}, "cveMetadata": {"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "assignerShortName": "CERTVDE", "cveId": "CVE-2022-22520", "datePublished": "2022-09-14T14:05:30.024889Z", "dateReserved": "2022-01-03T00:00:00", "dateUpdated": "2024-09-17T04:14:21.926Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mbconnectline:mbconnect24:*:*:*:*:*:*:*:*", "matchCriteriaId": "2D55D697-78A4-44E3-B6B6-E5349C610148", "versionEndIncluding": "2.11.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:mbconnectline:mymbconnect24:*:*:*:*:*:*:*:*", "matchCriteriaId": "04561EEC-B011-46F8-8C56-E5546D0ECD6A", "versionEndIncluding": "2.11.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:helmholz:myrex24:*:*:*:*:*:*:*:*", "matchCriteriaId": "8EE3EED2-43AC-4129-B2C8-88DEBFEF8BA0", "versionEndIncluding": "2.11.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:helmholz:myrex24.virtual:*:*:*:*:*:*:*:*", "matchCriteriaId": "847B9BE1-D7E5-4B6B-A59D-282BB58A8B64", "versionEndIncluding": "2.11.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A remote, unauthenticated attacker can enumerate valid users by sending specific requests to the webservice of MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2."}, {"lang": "es", "value": "Un atacante remoto no autenticado puede enumerar usuarios v\u00e1lidos mediante el env\u00edo de peticiones espec\u00edficas al webservice de la l\u00ednea de conexi\u00f3n MB mymbCONNECT24, mbCONNECT24 y Helmholz myREX24 y myREX24.virtual en todas las versiones hasta v2.11.2"}], "id": "CVE-2022-22520", "lastModified": "2022-10-01T02:33:08.290", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "info@cert.vde.com", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Secondary"}]}, "published": "2022-09-14T14:15:12.427", "references": [{"source": "info@cert.vde.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://cert.vde.com/en/advisories/VDE-2022-011"}, {"source": "info@cert.vde.com", "tags": ["Not Applicable"], "url": "https://cert.vde.com/en/advisories/VDE-2022-039"}], "sourceIdentifier": "info@cert.vde.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-204"}], "source": "info@cert.vde.com", "type": "Primary"}]}