CVE-2020-35564

Published: Feb 16, 2021Modified: Nov 21, 2024

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an outdated and unused component allowing for malicious user input of active code.

Affected (2)

Products: Mbconnectline: Mbconnect24, Mymbconnect24

Mbconnectline

2 products

Mbconnect24

Mymbconnect24

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Mbconnectline Mbconnect24	Up to 2.6.2
Mbconnectline Mymbconnect24	Up to 2.6.2

Related CWEs

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

References (4)

https://cert.vde.com/de-de/advisories/vde-2021-003

Source: cve@mitre.org

Third Party Advisory

https://mbconnectline.com/security-advice/

Source: cve@mitre.org

Vendor Advisory

https://cert.vde.com/de-de/advisories/vde-2021-003

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://mbconnectline.com/security-advice/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.