PT-2025-3687 · Megabip · Megabip

Krzysztof Gawkowski · Published 2025-01-10 · Updated 2025-01-10 · CVE-2024-6880

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions MegaBIP versions prior to 5.15

Description The issue arises during the MegaBIP installation process, where a user is advised to change the default path to the administrative portal as a protection mechanism. However, the publicly available source code of "registered.php" reveals this path, allowing an attacker to attempt further attacks.

Recommendations For MegaBIP versions prior to 5.15, update to version 5.15 or later to resolve the issue. As a temporary workaround, consider changing the default path to the administrative portal to a custom, secret path until a patch is available. Restrict access to the "registered.php" file to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-538

Related Identifiers

CVE-2024-6880

Affected Products

Megabip

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-6880 · Security Note
• https://twitter.com/CVEnew/status/1877782191935258721 · Twitter Post
• https://t.me/cvedetector/14983 · Telegram Post
• https://cert.pl/en/posts/2024/09/CVE-2024-6680 · Note
• https://megabip.pl · Note
• https://gov.pl/web/cyfryzacja/rekomendacja-pelnomocnika-rzadu-ds-cyberbezpieczenstwa-dotyczaca-biuletynow-informacji-publicznej · Note