description: An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2. There is an XSS issue in the redirect.php allowing an attacker to inject code via a get parameter.
problem types: CWE-79 Cross-site Scripting (XSS)
affected:
{
product: mymbCONNECT24
vendor: MB connect line
versions:
lessThanOrEqual: 2.6.2, status: affected, version: 2.6.2, versionType: custom
}
{
product: mbCONNECT24
vendor: MB connect line
versions:
lessThanOrEqual: 2.6.2, status: affected, version: 2.6.2, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
]
solutions: Update to v2.7.1