CVE-2024-6880

published 2025-01-10

CVE-2024-6880: During MegaBIP installation process, a user is encouraged to change a default path to administrative portal, as keeping it secret is listed by the author as…

Priority P3 38 medium 6.9 CVSS 4.0

AV N AC L AT N PR N UI N VC L VI N VA N SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

During MegaBIP installation process, a user is encouraged to change a default path to administrative portal, as keeping it secret is listed by the author as one of the protection mechanisms.
Publicly available source code of "/registered.php" discloses that path, allowing an attacker to attempt further attacks.

This issue affects MegaBIP software versions below 5.15

Affected

1 ranges

Vendor	Product	Version range	Fixed in
jan_syski	megabip	< 5.15	5.15

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-538