CoreCVE
Back

MEDIUM

Multiple vulnerabilities on Meta4 HR from Cegid

Published Mar 19, 2024

Description

A Cross-Site Scripting Vulnerability has been found on Meta4 HR affecting version 819.001.022 and earlier. The endpoint '/sitetest/english/dumpenv.jsp' is vulnerable to XSS attack by 'lang' query, i.e. '/sitetest/english/dumpenv.jsp?snoop=yes&lang=%27%3Cimg%20src/onerror=alert(1)%3E&params'.

Affected products

Remediation

Vendor solution

The Meta4 HR system administrator should remove the following pages from the web servers facing the Internet: From M4WebServices: The folder "sitetest" (containing the dumpenv.jsp page) From M4Gateway: The page dump.jsp In future releases of Cegid Meta4 HR, these pages will be removed from the distribution since they do not offer real functionality.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner INCIBE
Published Mar 19, 2024
Updated Aug 1, 2024
Reserved Mar 19, 2024
Link CVE-2024-2633
CISA Vulnrichment
Updated Mar 19, 2024
NVD
Status Deferred
Modified Jun 17, 2026
Link CVE-2024-2633
Red Hat
Severity n/a
Public date n/a
Links CVE-2024-2633
ENISA EUVD
Assigner INCIBE
Published Mar 19, 2024
Updated Aug 1, 2024
Exploited since n/a
Link EUVD-2024-27582
EUVD-2024-27582