{"api_version":"1","generated_at":"2026-07-23T14:55:41+00:00","cve":"CVE-2020-12530","urls":{"html":"https://cve.report/CVE-2020-12530","api":"https://cve.report/api/cve/CVE-2020-12530.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2020-12530","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-12530"},"summary":{"title":"CVE-2020-12530","description":"An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2. There is an XSS issue in the redirect.php allowing an attacker to inject code via a get parameter.","state":"PUBLIC","assigner":"info@cert.vde.com","published_at":"2021-03-02 22:15:00","updated_at":"2021-03-09 16:03:00"},"problem_types":["CWE-79"],"metrics":[],"references":[{"url":"https://cert.vde.com/de-de/advisories/vde-2021-003","name":"https://cert.vde.com/de-de/advisories/vde-2021-003","refsource":"CONFIRM","tags":["Third Party Advisory"],"title":"MB connect line: Multiple vulnerabilites in mymbCONNECT24 and mbCONNECT24 <= 2.6.2 — German (Germany)","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-12530","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-12530","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"LEGACY","value":"OTORIO reported the vulnerabilities to MB connect line. CERT@VDE coordinated.","lang":""}],"nvd_cpes":[{"cve_year":"2020","cve_id":"12530","vulnerable":"1","versionEndIncluding":"2.6.2","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mbconnectline","cpe5":"mbconnect24","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"12530","vulnerable":"1","versionEndIncluding":"2.6.2","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mbconnectline","cpe5":"mymbconnect24","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"info@cert.vde.com","DATE_PUBLIC":"2021-02-15T13:50:00.000Z","ID":"CVE-2020-12530","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"mymbCONNECT24","version":{"version_data":[{"version_affected":"<=","version_name":"2.6.2","version_value":"2.6.2"}]}},{"product_name":"mbCONNECT24","version":{"version_data":[{"version_affected":"<=","version_name":"2.6.2","version_value":"2.6.2"}]}}]},"vendor_name":"MB connect line"}]}},"credit":[{"lang":"eng","value":"OTORIO reported the vulnerabilities to MB connect line. CERT@VDE coordinated."}],"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2. There is an XSS issue in the redirect.php allowing an attacker to inject code via a get parameter."}]},"generator":{"engine":"Vulnogram 0.0.9"},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-79 Cross-site Scripting (XSS)"}]}]},"references":{"reference_data":[{"name":"https://cert.vde.com/de-de/advisories/vde-2021-003","refsource":"CONFIRM","url":"https://cert.vde.com/de-de/advisories/vde-2021-003"}]},"solution":[{"lang":"eng","value":"Update to v2.7.1"}],"source":{"advisory":"VDE-2021-003","discovery":"EXTERNAL"}},"nvd":{"publishedDate":"2021-03-02 22:15:00","lastModifiedDate":"2021-03-09 16:03:00","problem_types":["CWE-79"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.8,"impactScore":2.7},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":4.3},"severity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:mbconnectline:mbconnect24:*:*:*:*:*:*:*:*","versionEndIncluding":"2.6.2","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:mbconnectline:mymbconnect24:*:*:*:*:*:*:*:*","versionEndIncluding":"2.6.2","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2020","CveId":"12530","Ordinal":"173695","Title":"CVE-2020-12530","CVE":"CVE-2020-12530","Year":"2020"},"notes":[{"CveYear":"2020","CveId":"12530","Ordinal":"1","NoteData":"An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2. There is an XSS issue in the redirect.php allowing an attacker to inject code via a get parameter.","Type":"Description","Title":null},{"CveYear":"2020","CveId":"12530","Ordinal":"2","NoteData":"2021-03-02","Type":"Other","Title":"Published"},{"CveYear":"2020","CveId":"12530","Ordinal":"3","NoteData":"2021-03-02","Type":"Other","Title":"Modified"}]}}}