CVE-2020-24570

Name of the Vulnerable Software and Affected Versions mbCONNECT24 versions through 2.6.1 mymbCONNECT24 (affected versions not specified)

Description An issue was discovered that allows attackers to steal session information from logged-in users with a crafted link, due to a CSRF issue with resultant SSRF in the com mb24proxy module.

Recommendations For mbCONNECT24 versions through 2.6.1, update to a version that fixes the CSRF issue in the com mb24proxy module. For mymbCONNECT24, at the moment, there is no information about a newer version that contains a fix for this vulnerability.