{"document":{"acknowledgments":[{"names":["Sharon Brizinov","Tal Keren"],"organization":"OTORIO ","summary":"reported"},{"organization":"CERT@VDE","summary":"coordination"}],"category":"csaf_security_advisory","csaf_version":"2.0","distribution":{"tlp":{"label":"WHITE","url":"https://www.first.org/tlp/"}},"lang":"en-GB","notes":[{"category":"summary","text":"Multiples issues exist in mymbCONNECT24 and mbCONNECT24","title":"Summary"},{"category":"description","text":"Please consult the above CVEs for details.","title":"Impact"},{"category":"description","text":"Update mymbCONNECT24 and mbCONNECT24 to version >v2.6.1","title":"Remediation"}],"publisher":{"category":"vendor","contact_details":"security-team@mbconnectline.de","name":"MB connect line GmbH","namespace":"https://mbconnectline.com"},"references":[{"category":"external","summary":"CERT@VDE Security Advisories for MB connect line GmbH","url":"https://certvde.com/de/advisories/vendor/mbconnectline/"},{"category":"self","summary":"VDE-2020-035: MB connect line: Multiple Vulnerabilities in mymbCONNECT24 and mbCONNECT24 <= v2.6.1 - HTML","url":"https://certvde.com/de/advisories/VDE-2020-035/"},{"category":"self","summary":"VDE-2020-035: MB connect line: Multiple Vulnerabilities in mymbCONNECT24 and mbCONNECT24 <= v2.6.1 - CSAF","url":"https://mbconnectline.csaf-tp.certvde.com/.well-known/csaf/white/2020/vde-2020-035.json"}],"title":"MB connect line: Multiple Vulnerabilities in mymbCONNECT24 and mbCONNECT24 <= v2.6.1","tracking":{"aliases":["VDE-2020-035"],"current_release_date":"2025-05-14T12:28:19.000Z","generator":{"date":"2024-09-30T11:26:22.467Z","engine":{"name":"Secvisogram","version":"2.5.12"}},"id":"VDE-2020-035","initial_release_date":"2020-09-18T12:30:00.000Z","revision_history":[{"date":"2020-09-18T12:30:00.000Z","number":"1","summary":"Initial revision."},{"date":"2024-11-06T11:27:01.000Z","number":"2","summary":"Fix: added self-reference"},{"date":"2025-02-12T16:48:47.000Z","number":"3","summary":"Fix: corrected self-reference, fixed version"},{"date":"2025-05-14T12:28:19.000Z","number":"4","summary":"Fix: removed ia, added distribution"}],"status":"final","version":"4"}},"product_tree":{"branches":[{"branches":[{"branches":[{"branches":[{"category":"product_version_range","name":"<=2.6.1","product":{"name":"Software mbCONNECT24 <=2.6.1","product_id":"CSAFPID-51001"}},{"category":"product_version_range","name":">v2.6.1","product":{"name":"Software mbCONNECT24 >v2.6.1","product_id":"CSAFPID-52001"}}],"category":"product_name","name":"mbCONNECT24"},{"branches":[{"category":"product_version_range","name":"<=2.6.1","product":{"name":"Software mymbCONNECT24 <=2.6.1","product_id":"CSAFPID-51002"}},{"category":"product_version_range","name":">v2.6.1","product":{"name":"Software mymbCONNECT24 >v2.6.1","product_id":"CSAFPID-52002"}}],"category":"product_name","name":"mymbCONNECT24"}],"category":"product_family","name":"Software"}],"category":"vendor","name":"MB connect line"}],"product_groups":[{"group_id":"CSAFGID-0001","product_ids":["CSAFPID-51001","CSAFPID-51002"],"summary":"Affected products."},{"group_id":"CSAFGID-0002","product_ids":["CSAFPID-52001","CSAFPID-52002"],"summary":"Fixed products."}]},"vulnerabilities":[{"cve":"CVE-2020-24568","cwe":{"id":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"},"notes":[{"audience":"all","category":"description","text":"An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.1. There is a blind SQL injection in the lancompenent component, allowing logged-in attackers to discover arbitrary information.","title":"Vulnerability Description"}],"product_status":{"fixed":["CSAFPID-52001","CSAFPID-52002"],"known_affected":["CSAFPID-51001","CSAFPID-51002"]},"remediations":[{"category":"vendor_fix","details":"Update mymbCONNECT24 and mbCONNECT24 to version >v2.6.1","group_ids":["CSAFGID-0001"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","environmentalScore":6.5,"environmentalSeverity":"MEDIUM","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","temporalScore":6.5,"temporalSeverity":"MEDIUM","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["CSAFPID-51001","CSAFPID-51002"]}],"title":"CVE-2020-24568"},{"cve":"CVE-2020-24570","cwe":{"id":"CWE-352","name":"Cross-Site Request Forgery (CSRF)"},"notes":[{"audience":"all","category":"description","text":"An issue was discovered in the mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.1. There is a SSRF and CSRF issue, in the com_mb24proxy module, allowing attackers to steal session information from logged in users with a specifically crafted link.","title":"Vulnerability Description"}],"product_status":{"fixed":["CSAFPID-52001","CSAFPID-52002"],"known_affected":["CSAFPID-51001","CSAFPID-51002"]},"remediations":[{"category":"vendor_fix","details":"Update mymbCONNECT24 and mbCONNECT24 to version >v2.6.1","group_ids":["CSAFGID-0001"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","environmentalScore":6.5,"environmentalSeverity":"MEDIUM","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","temporalScore":6.5,"temporalSeverity":"MEDIUM","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"products":["CSAFPID-51001","CSAFPID-51002"]}],"title":"CVE-2020-24570"},{"cve":"CVE-2020-24569","cwe":{"id":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"},"notes":[{"category":"description","text":"An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.1. There is a blind SQL injection in the knximport component via an advanced attack vector, allowing logged in attackers to discover arbitrary information.","title":"Vulnerability Description"}],"product_status":{"fixed":["CSAFPID-52001","CSAFPID-52002"],"known_affected":["CSAFPID-51001","CSAFPID-51002"]},"remediations":[{"category":"vendor_fix","details":"Update mymbCONNECT24 and mbCONNECT24 to version >v2.6.1","group_ids":["CSAFGID-0001"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","environmentalScore":4.3,"environmentalSeverity":"MEDIUM","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","temporalScore":4.3,"temporalSeverity":"MEDIUM","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["CSAFPID-51001","CSAFPID-51002"]}],"title":"CVE-2020-24569"}]}