CVE-2022-22520CWE-204

User enumeration vulnerability in MB connect line and Helmholz products

Medium · published September 14, 2022

CVSS v3.1
5.3
EPSS
1%
Percentile
62.8
In the wild
Unconfirmed
What it is

A remote, unauthenticated attacker can enumerate valid users by sending specific requests to the webservice of MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01009 · 62.8th percentile
Weakness
CWE-204 · Observable Response Discrepancy
Published
2022-09-14T14:05Z
EPSS history
Timeline
  • 14 SEP 14:05Z
    User enumeration vulnerability in MB connect line and Helmholz products
    cvelistv5