CVE-2020-35570 : What You Need to Know

An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24, and Helmholz myREX24 and myREX24.virtual through version 2.11.2, allowing unauthenticated attackers to access restricted files through forceful browsing.

Understanding CVE-2020-35570

This CVE involves a forced browsing vulnerability in products of MB connect line and Helmholz.

What is CVE-2020-35570?

CVE-2020-35570 is a security vulnerability that enables unauthorized access to files that should have been restricted, potentially leading to unauthorized disclosure of information.

The Impact of CVE-2020-35570

The vulnerability has a CVSS base score of 5.3, with medium severity. It affects confidentiality to a low extent and does not impact integrity or availability.

Technical Details of CVE-2020-35570

This section provides more technical insights into the vulnerability.

Vulnerability Description

The vulnerability allows unauthenticated attackers to access files that should have been restricted via forceful browsing.

Affected Systems and Versions

Products affected: MB connect line mymbCONNECT24, mbCONNECT24, Helmholz myREX24, and myREX24.virtual
Vulnerable versions: Up to and including 2.11.2

Exploitation Mechanism

The vulnerability can be exploited by unauthenticated attackers through forceful browsing to access files that are meant to be restricted.

Mitigation and Prevention

To address CVE-2020-35570, follow these mitigation strategies:

Immediate Steps to Take

Update the affected products to version 2.12.1

Long-Term Security Practices

Implement access controls to restrict unauthorized file access
Regularly monitor and audit file access permissions

Patching and Updates

Apply patches and updates provided by the vendor to fix the vulnerability