{"id":"CVE-2024-2635","state":"PUBLISHED","title":"Multiple vulnerabilities on Meta4 HR from Cegid","description":" The configuration pages available are not intended to be placed on an Internet facing web server, as they expose file paths to the client, who can be an attacker. Instead of rewriting these pages to avoid this vulnerability, they will be dismissed from future releases of Cegid Meta4 HR, as they do not offer product functionality ","publishedAt":"2024-03-19T12:09:48.232Z","updatedAt":"2024-08-21T17:46:06.799Z","severity":{"score":7.3,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","source":"INCIBE"},"assigner":"INCIBE","products":["Cegid Meta4 HR"],"affected":[{"vendor":"Cegid","product":"Meta4 HR","defaultStatus":"unaffected","versions":[{"version":"819.001.022","status":"affected"}]}],"references":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-meta4-hr-cegid"],"weaknesses":["CWE-698"],"ingestedAt":"2026-10-29T20:07:21.467Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/2xxx/CVE-2024-2635.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-2635","state":"PUBLISHED","datePublished":"2024-03-19T12:09:48.232Z","dateUpdated":"2024-08-21T17:46:06.799Z","assignerShortName":"INCIBE","assignerOrgId":"0cbda920-cd7f-484a-8e76-bf7f4b7f4516","dateReserved":"2024-03-19T06:45:01.569Z"},"containers":{"cna":{"title":"Multiple vulnerabilities on Meta4 HR from Cegid","descriptions":[{"lang":"en","value":" The configuration pages available are not intended to be placed on an Internet facing web server, as they expose file paths to the client, who can be an attacker. Instead of rewriting these pages to avoid this vulnerability, they will be dismissed from future releases of Cegid Meta4 HR, as they do not offer product functionality "}],"affected":[{"vendor":"Cegid","product":"Meta4 HR","defaultStatus":"unaffected","versions":[{"version":"819.001.022","status":"affected"}]}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-meta4-hr-cegid"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-698","description":"CWE-698: Execution After Redirect (EAR)","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"INCIBE","orgId":"0cbda920-cd7f-484a-8e76-bf7f4b7f4516","dateUpdated":"2024-03-19T12:16:04.540Z"},"credits":[{"lang":"en","type":"reporter","user":"00000000-0000-4000-9000-000000000000","value":"Jesús Antón "}],"datePublic":"2024-03-19T13:33:00.000Z","solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The configuration pages available are not intended to be placed on an Internet facing web server, as they expose file paths to the client, who can be an attacker. Instead of rewriting these pages to avoid this vulnerability, they will be dismissed from future releases of Cegid Meta4 HR, as they do not offer product functionality.<br>"}],"value":"The configuration pages available are not intended to be placed on an Internet facing web server, as they expose file paths to the client, who can be an attacker. Instead of rewriting these pages to avoid this vulnerability, they will be dismissed from future releases of Cegid Meta4 HR, as they do not offer product functionality.\n"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-meta4-hr-cegid","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T19:18:47.986Z"}},{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"cegid","product":"meta4_hr","defaultStatus":"unknown","versions":[{"version":"819.001.022","status":"affected"}],"cpes":["cpe:2.3:a:cegid:meta4_hr:819.001.022:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-08-21T17:45:05.399193Z","id":"CVE-2024-2635","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-08-21T17:46:06.799Z"}}]}}}