← Voltar para CVEs

CVE-2024-1577

CRITICAL

9.8

Descricao

Remote Code Execution vulnerability in MegaBIP software allows to execute arbitrary code on the server without requiring authentication by saving crafted by the attacker PHP code to one of the website files. This issue affects MegaBIP software versions through 5.11.2.

Detalhes CVE

Pontuacao CVSS v3.19.8

SeveridadeCRITICAL

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosNONE

Interacao do usuarioNONE

Publicado6/12/2024

Ultima modificacao11/21/2024

Fontenvd

Avistamentos honeypot0

Produtos afetados

megabip:megabip

Fraquezas (CWE)

CWE-94CWE-94

Referencias

https://cert.pl/en/posts/2024/06/CVE-2024-1576/(cvd@cert.pl)

https://cert.pl/posts/2024/06/CVE-2024-1576/(cvd@cert.pl)

https://megabip.pl/(cvd@cert.pl)

https://www.gov.pl/web/cyfryzacja/rekomendacja-pelnomocnika-rzadu-ds-cyberbezpieczenstwa-dotyczaca-biuletynow-informacji-publicznej(cvd@cert.pl)

https://cert.pl/en/posts/2024/06/CVE-2024-1576/(af854a3a-2127-422b-91ae-364da2661108)

https://cert.pl/posts/2024/06/CVE-2024-1576/(af854a3a-2127-422b-91ae-364da2661108)

https://megabip.pl/(af854a3a-2127-422b-91ae-364da2661108)

https://www.gov.pl/web/cyfryzacja/rekomendacja-pelnomocnika-rzadu-ds-cyberbezpieczenstwa-dotyczaca-biuletynow-informacji-publicznej(af854a3a-2127-422b-91ae-364da2661108)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.