Vulnerability · Published Dec 16, 2024 · Assigned by VulDB

CVE-2024-12663funnyzpc Mee-Admin Login login observable response discrepancy

Low 3.7

In plain English

A low-severity security flaw in Mee-Admin from funnyzpc. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 3.1)3.7Low

Exploit odds (30 days)0.4%top 61.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability classified as problematic was found in funnyzpc Mee-Admin up to 1.6. This vulnerability affects unknown code of the file /mee/login of the component Login. The manipulation of the argument username leads to observable response discrepancy. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.

Affected products (as reported)

Vendor	Product	Versions
funnyzpc	Mee-Admin	1.01.11.21.31.41.51.6

Weakness: CWE-204, CWE-203 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References

VDB-288532 | funnyzpc Mee-Admin Login login observable response discrepancy vdb-entry, technical-description
VDB-288532 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #458371 | funnyzpc mee-admin 1.6 Information Exposure Through Discrepancy third-party-advisory
https://github.com/funnyzpc/mee-admin/issues/9 exploit, issue-tracking