CVE-2020-35570

{"id": "CVE-2020-35570", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2021-02-16T16:15:13.830", "references": [{"url": "https://cert.vde.com/en/advisories/VDE-2021-003", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://cert.vde.com/en/advisories/VDE-2022-039", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://mbconnectline.com/security-advice/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://cert.vde.com/en/advisories/VDE-2021-003", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://cert.vde.com/en/advisories/VDE-2022-039", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://mbconnectline.com/security-advice/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-425"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual through 2.11.2. An unauthenticated attacker is able to access files (that should have been restricted) via forceful browsing."}, {"lang": "es", "value": "Se detect\u00f3 un problema en la l\u00ednea de conexi\u00f3n MB mymbCONNECT24, mbCONNECT24 y Helmholz myREX24 y myREX24.virtual hasta la versi\u00f3n 2.11.2. Un atacante no autenticado es capaz de acceder a archivos (que deber\u00edan haber sido restringidos) a trav\u00e9s de la navegaci\u00f3n forzada."}], "lastModified": "2024-11-21T05:27:36.200", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mbconnectline:mbconnect24:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2D55D697-78A4-44E3-B6B6-E5349C610148", "versionEndIncluding": "2.11.2"}, {"criteria": "cpe:2.3:a:mbconnectline:mymbconnect24:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "04561EEC-B011-46F8-8C56-E5546D0ECD6A", "versionEndIncluding": "2.11.2"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:helmholz:myrex24:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8EE3EED2-43AC-4129-B2C8-88DEBFEF8BA0", "versionEndIncluding": "2.11.2"}, {"criteria": "cpe:2.3:a:helmholz:myrex24.virtual:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "847B9BE1-D7E5-4B6B-A59D-282BB58A8B64", "versionEndIncluding": "2.11.2"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}