CVE-2023-0985 HIGH

CVE-2023-0985: Helmholz and MB Connect Line: Account takeover via password reset in multiple products

Vendor Mb Connect Line
Product mbCONNECT24
Weakness CWE-639 · IDOR
Published June 6, 2023
Last update January 7, 2025
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

An Authorization Bypass vulnerability was found in MB Connect Lines mbCONNECT24, mymbCONNECT24 and Helmholz' myREX24 and myREX24.virtual version <= 2.13.3. An authenticated remote user with low privileges can change the password of any user in the same account. This allows to take over the admin user and therefore fully compromise the account.

Key dates

02Disclosure timeline

June 6, 2023 CVE published
January 7, 2025 Record updated