CVE-2020-10381

An issue was discovered in the MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 software in all versions through 2.5.0. There is an unauthenticated SQL injection in DATA24, allowing attackers to discover database and table names.
References
Link Resource
https://mbconnectline.com/security-advice/ Patch Vendor Advisory
https://mbconnectline.com/security-advice/ Patch Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:mbconnectline:mbconnect24:*:*:*:*:*:*:*:*
cpe:2.3:a:mbconnectline:mymbconnect24:*:*:*:*:*:*:*:*

History

21 Nov 2024, 04:55

Type Values Removed Values Added
References () https://mbconnectline.com/security-advice/ - Patch, Vendor Advisory () https://mbconnectline.com/security-advice/ - Patch, Vendor Advisory

Information

Published : 2020-04-14 17:15

Updated : 2024-11-21 04:55


NVD link : CVE-2020-10381

Mitre link : CVE-2020-10381

CVE.ORG link : CVE-2020-10381


JSON object : View

Products Affected

mbconnectline

  • mbconnect24
  • mymbconnect24
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')