HIGH🇵🇱 Wersja polska

CVE-2021-34580

CVSS 7.5v3.1pub. 2021-10-27upd. 2024-11-21

In mymbCONNECT24, mbCONNECT24 <= 2.9.0 an unauthenticated user can enumerate valid backend users by checking what kind of response the server sends for crafted invalid login attempts.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

  • Mbconnectline Mbconnect24

    APP
    Mbconnectline
    ≤ 2.9.0

  • Mbconnectline Mymbconnect24

    APP
    Mbconnectline
    ≤ 2.9.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2026-33615CRITICAL9.1PL ✓same product

SQL Injection w endpoincie setinfo produktów Mbconnectline

CVE-2020-35565CRITICAL9.8PL ✓same product

Brak domyślnej ochrony przed brute force w MB CONNECT LINE mymbCONNECT24

CVE-2020-10383CRITICAL9.8PL ✓same product

RCE bez uwierzytelnienia w MB CONNECT LINE mymbCONNECT24 i mbCONNECT24

CVE-2026-33613HIGH7.2same product

Due to the improper neutralisation of special elements used in an OS command, a remote attacker can exploit an...

CVE-2026-33614HIGH7.5same product

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getinfo e...