title: User enumeration vulnerability in MB connect line and Helmholz products
description: A remote, unauthenticated attacker can enumerate valid users by sending specific requests to the webservice of MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2.
problem types: CWE-204 Response Discrepancy Information Exposure
affected:
{
product: mymbCONNECT24
vendor: MB connect line
versions:
lessThanOrEqual: 2.11.2, status: affected, version: 2, versionType: custom
}
{
product: mbCONNECT24
vendor: MB connect line
versions:
lessThanOrEqual: 2.11.2, status: affected, version: 2, versionType: custom
}
{
product: myREX24
vendor: Helmholz
versions:
lessThanOrEqual: 2.11.2, status: affected, version: 2, versionType: custom
}
{
product: myREX24.virtual
vendor: Helmholz
versions:
lessThanOrEqual: 2.11.2, status: affected, version: 2, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
]
solutions: Update to Version 2.12.1