CVE-2024-2636 — Multiple vulnerabilities on Meta4 HR from Cegid

CVE-2024-2636

Multiple vulnerabilities on Meta4 HR from Cegid PUBLISHED

Description (CNA)

An Unrestricted Upload of File vulnerability has been found on Cegid Meta4 HR, that allows an attacker to upload malicios files to the server via '/config/espanol/update_password.jsp' file. Modifying the 'M4_NEW_PASSWORD' parameter, an attacker could store a malicious JSP file inside the file directory, to be executed the the file is loaded in the application.

Affected (CNA)

Vendor / product	Versions
Cegid / Meta4 HR	affected 819.001.022

CWE

CWE-434

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-meta4-hr-cegid

ADP enrichment

CVE

No English description supplied.

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-meta4-hr-cegid

CISA-ADP

No English description supplied.

No references supplied.