2 lines
5.0 KiB
JSON
2 lines
5.0 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MegaBIP","repo":"https://megabip.pl/pobierz/1","vendor":"Jan Syski","versions":[{"lessThanOrEqual":"5.11.2","status":"affected","version":"0","versionType":"custom"}]}],"source":"cvd@cert.pl"},{"affectedData":[{"cpes":["cpe:2.3:a:jan_syski:megabip:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"megabip","vendor":"jan_syski","versions":[{"lessThanOrEqual":"5.11.2","status":"affected","version":"0","versionType":"custom"}]}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:megabip:megabip:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6DA36F-518E-4F83-B106-126ADB3E42CC","versionEndIncluding":"5.11.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Remote Code Execution vulnerability in MegaBIP software allows to execute arbitrary code on the server without requiring authentication by saving crafted by the attacker PHP code to one of the website files. This issue affects MegaBIP software versions through 5.11.2."},{"lang":"es","value":"La vulnerabilidad de ejecución remota de código en el software MegaBIP permite ejecutar código arbitrario en el servidor sin requerir autenticación al guardar el código PHP creado por el atacante en uno de los archivos del sitio web. Este problema afecta a todas las versiones del software MegaBIP."}],"id":"CVE-2024-1577","lastModified":"2026-06-17T07:04:33.920","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"YES","Recovery":"IRRECOVERABLE","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"AMBER","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"DIFFUSE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:I/V:D/RE:M/U:Amber","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"MODERATE"},"source":"cvd@cert.pl","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-1577","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2024-06-20T20:05:42.483632Z","version":"2.0.3"}}]},"published":"2024-06-12T14:15:10.683","references":[{"source":"cvd@cert.pl","tags":["Third Party Advisory"],"url":"https://cert.pl/en/posts/2024/06/CVE-2024-1576/"},{"source":"cvd@cert.pl","tags":["Third Party Advisory"],"url":"https://cert.pl/posts/2024/06/CVE-2024-1576/"},{"source":"cvd@cert.pl","tags":["Product"],"url":"https://megabip.pl/"},{"source":"cvd@cert.pl","tags":["Press/Media Coverage"],"url":"https://www.gov.pl/web/cyfryzacja/rekomendacja-pelnomocnika-rzadu-ds-cyberbezpieczenstwa-dotyczaca-biuletynow-informacji-publicznej"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://cert.pl/en/posts/2024/06/CVE-2024-1576/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://cert.pl/posts/2024/06/CVE-2024-1576/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Product"],"url":"https://megabip.pl/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Press/Media Coverage"],"url":"https://www.gov.pl/web/cyfryzacja/rekomendacja-pelnomocnika-rzadu-ds-cyberbezpieczenstwa-dotyczaca-biuletynow-informacji-publicznej"}],"sourceIdentifier":"cvd@cert.pl","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"cvd@cert.pl","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-94"}],"source":"nvd@nist.gov","type":"Primary"}]}
|