PT-2025-22650 · Megabip · Megabip

Kamil Szczurowski + 1 · Published 2025-05-23 · Updated 2025-05-23 · CVE-2025-3895

Positive Technologies (AI Summary)

CVSS v4.0

9.1

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions MegaBIP versions prior to 5.20

Description The issue arises from the generation of password reset tokens in MegaBIP software, which uses a small space of random values combined with a queryable value. This allows an unauthenticated attacker who knows user login names to brute force these tokens and change account passwords, including those belonging to administrators.

Recommendations For versions prior to 5.20, update to version 5.20 to fix this issue. As a temporary workaround, consider restricting access to password reset functionality until the update is applied. Avoid using the password reset feature with queryable values until the issue is resolved.

Fix

Weakness Enumeration

CWE-334

Related Identifiers

CVE-2025-3895

Affected Products

Megabip

References · 10

• https://megabip.pl/index.php?id=24,145 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-3895 · Security Note
• https://twitter.com/VulmonFeeds/status/1925877880426209473 · Twitter Post
• https://cert.pl/en/posts/2025/05/CVE-2025-3893 · Note
• https://twitter.com/CVEnew/status/1925879141011783848 · Twitter Post
• https://t.me/cvetracker/24529 · Telegram Post
• https://t.me/cvenotify/123424 · Telegram Post
• https://t.me/latest_high_impact_cve/2445 · Telegram Post
• https://twitter.com/CveFindCom/status/1925864440064258521 · Twitter Post
• https://gov.pl/web/cyfryzacja/rekomendacja-pelnomocnika-rzadu-ds-cyberbezpieczenstwa-dotyczaca-biuletynow-informacji-publicznej · Note