CVE-2022-22520 MEDIUM

CVE-2022-22520: User enumeration vulnerability in MB connect line and Helmholz products

Vendor Mb Connect Line
Product mymbCONNECT24
Weakness CWE-204
Published September 14, 2022
Last update September 17, 2024
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

A remote, unauthenticated attacker can enumerate valid users by sending specific requests to the webservice of MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2.

Key dates

02Disclosure timeline

September 14, 2022 CVE published
September 17, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-28358 NocoDB: User Enumeration via Password Reset Endpoint CVE-2026-25509 CI4MS Vulnerable to User Email Enumeration via Password Reset Flow CVE-2025-12455 Username Enumeration Observable Response Discrepancy vulnerability has been discovered in OpenText™ Vertica. CVE-2026-24664 Open eClass is Vulnerable to Username Enumeration via Login Response Discrepancies CVE-2026-53422 SFTP REALPATH path-existence oracle allowing filesystem enumeration outside configured root