CVE-2024-2635

Published: Mar 19, 2024Modified: Jun 17, 2026Deferred

7.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Exploitability: 3.9 / Impact: 3.4

Source: cve-coordination@incibe.es (Secondary)

Description

The configuration pages available are not intended to be placed on an Internet facing web server, as they expose file paths to the client, who can be an attacker. Instead of rewriting these pages to avoid this vulnerability, they will be dismissed from future releases of Cegid Meta4 HR, as they do not offer product functionality

Related CWEs

CWE-698

Execution After Redirect (EAR)

The web application sends a redirect to another location, but instead of exiting, it executes additional code.

References (2)

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-meta4-hr-cegid

Source: cve-coordination@incibe.es

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-meta4-hr-cegid

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.