CVE-2022-22520 Information

Description

A remote unauthenticated attacker can enumerate valid users by sending specific requests to the webservice of MB connect line mymbCONNECT24 mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Reference

https://cert.vde.com/en/advisories/VDE-2022-039 https://cert.vde.com/en/advisories/VDE-2022-011

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

NONE

Base Score

NONE

Base Severity

7.5