CVE-2023-0985

Helmholz and MB Connect Line: Account takeover via password reset in multiple products

State: Published
Severity: 8.8 High
Published: Jun 6, 2023
Updated: Jan 7, 2025
Reserved: Feb 23, 2023

Description

An Authorization Bypass vulnerability was found in MB Connect Lines mbCONNECT24, mymbCONNECT24 and Helmholz' myREX24 and myREX24.virtual version <= 2.13.3. An authenticated remote user with low privileges can change the password of any user in the same account. This allows to take over the admin user and therefore fully compromise the account.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CERTVDE

Weaknesses

CWE-639 Authorization Bypass Through User-Controlled Key

Affected Products

Product	Versions
mbCONNECT24MB Connect Line	1.0.0 through 2.13.3Affected
mymbCONNECT24MB Connect Line	1.0.0 through 2.13.3Affected
myREX24Helmholz	2.13.3 and earlierAffected
myREX24.virtualHelmholz	2.13.3 and earlierAffected

References

https://cert.vde.com/en/advisories/VDE-2023-002/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.