CVE-2020-35565

An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2

published February 16, 2021

CVSS
โ€”
EPSS
1%
Percentile
65.0
In the wild
Unconfirmed
What it is

โš ๏ธ A login page without bruteforce detection is like leaving the front door wide open โ€” an invitation for trouble! ๐Ÿ”“ Imagine an office with no security guard at the entrance. Anyone can walk in and try to guess the code to access sensitive documents, and with no one stopping them, it could quickly turn chaotic! Without bruteforce detection enabled by default, attackers could repeatedly attempt to guess passwords, potentially gaining unauthorized access to user accounts. This oversight could lead to data breaches or malicious activities, compromising the security of your sensitive information.

Put simply

Imagine an office with no security guard at the entrance. Anyone can walk in and try to guess the code to access sensitive documents, and with no one stopping them, it could quickly turn chaotic! This vulnerability in MB CONNECT LINE mymbCONNECT24 prevents the system from blocking multiple failed login attempts, enabling brute force attacks on user accounts without any deterrent.

What to do

Without bruteforce detection enabled by default, attackers could repeatedly attempt to guess passwords, potentially gaining unauthorized access to user accounts. This oversight could lead to data breaches or malicious activities, compromising the security of your sensitive information. To mitigate this risk, ensure that bruteforce detection is enabled on your login pages. Regularly review your security settings and consider implementing additional measures, such as account lockout policies after a certain number of failed attempts. You can tackle this issue easily! Enable bruteforce detection and keep your system secure! ๐Ÿ›ก๏ธ

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01088 ยท 65.0th percentile
Published
2021-02-16T15:47Z
EPSS history
Timeline
  • 16 FEB 15:47Z
    An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2
    cvelistv5