PT-2020-15744
CVE-2020-24570
·
تاريخ النشر
2020-09-29
·
تاريخ التحديث
2021-07-21
الوصف من
CVSS 3.1
6.5
متوسطةالمقاييسAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions
mbCONNECT24 versions through 2.6.1
mymbCONNECT24 (affected versions not specified)
Description
An issue was discovered that allows attackers to steal session information from logged-in users with a crafted link, due to a CSRF issue with resultant SSRF in the com mb24proxy module.
Recommendations
For mbCONNECT24 versions through 2.6.1, update to a version that fixes the CSRF issue in the com mb24proxy module.
For mymbCONNECT24, at the moment, there is no information about a newer version that contains a fix for this vulnerability.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾