CVE-2025-3895
Low token entropy in MegaBIP
- State
- Published
- Severity
- 9.1 Critical
- Published
- May 23, 2025
- Updated
- May 23, 2025
- Reserved
- Apr 23, 2025
Description
Token used for resetting passwords in MegaBIP software are generated using a small space of random values combined with a queryable value. It allows an unauthenticated attacker who know user login names to brute force these tokens and change account passwords (including these belonging to administrators). Version 5.20 of MegaBIP fixes this issue.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.1 Critical | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N | CERT-PL |
Weaknesses
- CWE-334 Small Space of Random Values
Affected Products
| Product | Versions |
|---|---|
MegaBIPJan Syski |
|
References
- https://cert.pl/en/posts/2025/05/CVE-2025-3893third-party-advisory
- https://megabip.pl/index.php?id=24,145vendor-advisory
- https://www.gov.pl/web/cyfryzacja/rekomendacja-pelnomocnika-rzadu-ds-cyberbezpieczenstwa-dotyczaca-biuletynow-informacji-publicznejgovernment-resource
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.