CVE-2023-0985CWE-639

Helmholz and MB Connect Line: Account takeover via password reset in multiple products

High · published June 6, 2023

CVSS v3.1
8.8
EPSS
1%
Percentile
55.9
In the wild
Unconfirmed
What it is

An Authorization Bypass vulnerability was found in MB Connect Lines mbCONNECT24, mymbCONNECT24 and Helmholz' myREX24 and myREX24.virtual version <= 2.13.3. An authenticated remote user with low privileges can change the password of any user in the same account. This allows to take over the admin user and therefore fully compromise the account.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00794 · 55.9th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2023-06-06T10:06Z
EPSS history
Timeline
  • 06 JUN 10:06Z
    Helmholz and MB Connect Line: Account takeover via password reset in multiple products
    cvelistv5