{"id":"CVE-2020-12530","state":"PUBLISHED","title":"An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2. There is an XSS issue in the redirect.php allowing an attacker to ","description":"An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2. There is an XSS issue in the redirect.php allowing an attacker to inject code via a get parameter.","publishedAt":"2021-03-02T21:15:25.258Z","updatedAt":"2024-09-16T19:55:41.845Z","severity":{"score":4.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","source":"CERTVDE"},"assigner":"CERTVDE","products":["MB connect line mymbCONNECT24","MB connect line mbCONNECT24"],"affected":[{"vendor":"MB connect line","product":"mymbCONNECT24","versions":[{"version":"2.6.2","status":"affected","lessThanOrEqual":"2.6.2","versionType":"custom"}]},{"vendor":"MB connect line","product":"mbCONNECT24","versions":[{"version":"2.6.2","status":"affected","lessThanOrEqual":"2.6.2","versionType":"custom"}]}],"references":["https://cert.vde.com/de-de/advisories/vde-2021-003"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T19:46:27.697Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2020/12xxx/CVE-2020-12530.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2020-12530","state":"PUBLISHED","datePublished":"2021-03-02T21:15:25.258Z","dateUpdated":"2024-09-16T19:55:41.845Z","assignerShortName":"CERTVDE","assignerOrgId":"270ccfa6-a436-4e77-922e-914ec3a9685c","dateReserved":"2020-04-30T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2. There is an XSS issue in the redirect.php allowing an attacker to inject code via a get parameter."}],"affected":[{"vendor":"MB connect line","product":"mymbCONNECT24","versions":[{"version":"2.6.2","status":"affected","lessThanOrEqual":"2.6.2","versionType":"custom"}]},{"vendor":"MB connect line","product":"mbCONNECT24","versions":[{"version":"2.6.2","status":"affected","lessThanOrEqual":"2.6.2","versionType":"custom"}]}],"references":[{"url":"https://cert.vde.com/de-de/advisories/vde-2021-003","tags":["x_refsource_CONFIRM"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79 Cross-site Scripting (XSS)","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"CERTVDE","dateUpdated":"2021-03-02T21:15:25.000Z","orgId":"270ccfa6-a436-4e77-922e-914ec3a9685c"},"credits":[{"lang":"en","value":"OTORIO reported the vulnerabilities to MB connect line. CERT@VDE coordinated."}],"datePublic":"2021-02-15T00:00:00.000Z","solutions":[{"lang":"en","value":"Update to v2.7.1"}],"source":{"advisory":"VDE-2021-003","discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.0.9"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"info@cert.vde.com","DATE_PUBLIC":"2021-02-15T13:50:00.000Z","ID":"CVE-2020-12530","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"mymbCONNECT24","version":{"version_data":[{"version_affected":"<=","version_name":"2.6.2","version_value":"2.6.2"}]}},{"product_name":"mbCONNECT24","version":{"version_data":[{"version_affected":"<=","version_name":"2.6.2","version_value":"2.6.2"}]}}]},"vendor_name":"MB connect line"}]}},"credit":[{"lang":"eng","value":"OTORIO reported the vulnerabilities to MB connect line. CERT@VDE coordinated."}],"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2. There is an XSS issue in the redirect.php allowing an attacker to inject code via a get parameter."}]},"generator":{"engine":"Vulnogram 0.0.9"},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-79 Cross-site Scripting (XSS)"}]}]},"references":{"reference_data":[{"name":"https://cert.vde.com/de-de/advisories/vde-2021-003","refsource":"CONFIRM","url":"https://cert.vde.com/de-de/advisories/vde-2021-003"}]},"solution":[{"lang":"en","value":"Update to v2.7.1"}],"source":{"advisory":"VDE-2021-003","discovery":"EXTERNAL"}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://cert.vde.com/de-de/advisories/vde-2021-003","tags":["x_refsource_CONFIRM","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T11:56:52.104Z"}}]}}}