Riskcovery

CVE-2021-34574

Password policy evasion in products of MB connect line and Helmholz

State
Published
Severity
4.3 Medium
Published
Aug 2, 2021
Updated
Sep 16, 2024
Reserved
Jun 10, 2021

Read the record on cve.org

Description

In MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2 an authenticated attacker can change the password of his account into a new password that violates the password policy by intercepting and modifying the request that is send to the server.

Scores

CVSSScoreVectorSource
3.14.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NCERTVDE

Weaknesses

  • CWE-669 Incorrect Resource Transfer Between Spheres

Affected Products

ProductVersions
mymbCONNECT24MB connect line
  • 2 through 2.11.2Affected
mbCONNECT24MB connect line
  • 2 through 2.11.2Affected
myREX24Helmholz
  • 2 through 2.11.2Affected
myREX24.virtualHelmholz
  • 2 through 2.11.2Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.