CVE-2023-4834
Assigner: CERTVDE
Published: 2023-10-16T08:40:13.064Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: mbCONNECT24
vendor: Red Lion Europe
versions: lessThanOrEqual: 2.14.2
status: affected
version: 0
versionType: semver
defaultStatus: unaffected
product: mymbCONNECT24
vendor: Red Lion Europe
versions: lessThanOrEqual: 2.14.2
status: affected
version: 0
versionType: semver
defaultStatus: unaffected
product: myREX24
vendor: Helmholz
versions: lessThanOrEqual: 2.14.2
status: affected
version: 0
versionType: semver
defaultStatus: unaffected
product: myREX24.virtual
vendor: Helmholz
versions: lessThanOrEqual: 2.14.2
status: affected
version: 0
versionType: semver
datePublic: 2023-10-16T08:40:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: <div><div><div><div><p>In <span style="background-color: rgb(249, 250, 251);">Red Lion Europe&nbsp;</span><span style="background-color: rgb(249, 250, 251);">mbCONNECT24 and mymbCONNECT24 and Helmholz myREX24 and myREX24.virtual up to and including 2.14.2 an&nbsp;</span>improperly implemented access validation <span style="background-color: rgb(255, 255, 255);">allows an authenticated, </span><span style="background-color: rgb(255, 255, 255);">low privileged</span><span style="background-color: rgb(255, 255, 255);">&nbsp;attacker to gain read access to limited, non-critical device information in his account he should not have access to.</span>
</p>
					</div>
				</div>
			</div>
		</div>
	

value: In Red Lion Europe mbCONNECT24 and mymbCONNECT24 and Helmholz myREX24 and myREX24.virtual up to and including 2.14.2 an improperly implemented access validation allows an authenticated, low privileged attacker to gain read access to limited, non-critical device information in his account he should not have access to.



					


				


			


		


	

metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-269
description: CWE-269 Improper Privilege Management
type: CWE
source: defect: CERT@VDE#64587
discovery: EXTERNAL
x_generator: engine: Vulnogram 0.1.0-dev