CVE-2023-0985

Published: Jun 6, 2023Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: info@cert.vde.com (Secondary)

Description

An Authorization Bypass vulnerability was found in MB Connect Lines mbCONNECT24, mymbCONNECT24 and Helmholz' myREX24 and myREX24.virtual version <= 2.13.3. An authenticated remote user with low privileges can change the password of any user in the same account. This allows to take over the admin user and therefore fully compromise the account.

Affected (2)

Products: Mbconnectline: Mbconnect24, Mymbconnect24

2 products

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Mbconnectline Mbconnect24	Up to 2.13.3
Mbconnectline Mymbconnect24	Up to 2.13.3

Related CWEs

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (2)

https://cert.vde.com/en/advisories/VDE-2023-002/

Source: info@cert.vde.com

MitigationThird Party Advisory

https://cert.vde.com/en/advisories/VDE-2023-002/

Source: af854a3a-2127-422b-91ae-364da2661108

MitigationThird Party Advisory

Timeline

No history available yet.