User enumeration vulnerability in MB connect line and Helmholz products
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.8%
exploitation probability
0.8%top 46% of all CVEs
observed exploitation
nono source reports it
In short
An attacker can discover valid usernames by sending specially crafted requests to the web service without needing to log in. This information can be used to launch further attacks like password guessing.
Technical detail
User enumeration vulnerability via information disclosure (CWE-204) in unauthenticated webservice endpoints. Remote attacker can differentiate between valid and invalid usernames through response analysis, enabling targeted credential attacks without prior authentication.
Summary generated and translated by AI from the official description.
A remote, unauthenticated attacker can enumerate valid users by sending specific requests to the webservice of MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N