Back to overview

MB connect line: Multiple Vulnerabilities in mymbCONNECT24 and mbCONNECT24 <= v2.6.1

VDE-2020-035
Last update
05/14/2025 14:28
Published at
09/18/2020 14:30
Vendor(s)
MB connect line GmbH
External ID
VDE-2020-035
CSAF Document
Download

Summary

Multiples issues exist in mymbCONNECT24 and mbCONNECT24

Impact

Please consult the above CVEs for details.

Affected Product(s)

Model no. Product name Affected versions
Software mbCONNECT24 <=2.6.1 Software mbCONNECT24 <=2.6.1
Software mymbCONNECT24 <=2.6.1 Software mymbCONNECT24 <=2.6.1

Vulnerabilities

Expand / Collapse all

Published
09/22/2025 14:58
Severity
6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness
Cross-Site Request Forgery (CSRF) (CWE-352)
Summary

An issue was discovered in the mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.1. There is a SSRF and CSRF issue, in the com_mb24proxy module, allowing attackers to steal session information from logged in users with a specifically crafted link.

References
cve.org | nvd.nist.gov

Published
09/22/2025 14:58
Severity
6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Summary

An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.1. There is a blind SQL injection in the lancompenent component, allowing logged-in attackers to discover arbitrary information.

References
cve.org | nvd.nist.gov

Published
09/22/2025 14:58
Severity
4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Summary

An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.1. There is a blind SQL injection in the knximport component via an advanced attack vector, allowing logged in attackers to discover arbitrary information.

References
cve.org | nvd.nist.gov

Remediation

Update mymbCONNECT24 and mbCONNECT24 to version >v2.6.1

Revision History

Version Date Summary
1 09/18/2020 14:30 Initial revision.
2 11/06/2024 12:27 Fix: added self-reference
3 02/12/2025 17:48 Fix: corrected self-reference, fixed version
4 05/14/2025 14:28 Fix: removed ia, added distribution