CVE-2024-0191 RRJ Nueva Ecija Engineer Online Portal file information disclosure

Medium 5.3 Published 2 Jan 2024 Updated 3 Jun 2025

Remote attackers can access file and directory information in the RRJ Nueva Ecija Engineer Online Portal admin uploads directory.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-0191?

CVE-2024-0191 is a medium-severity vulnerability in RRJ Nueva Ecija Engineer Online Portal, published on 2 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability was found in RRJ Nueva Ecija Engineer Online Portal 1.0. It has been classified as problematic. Affected is an unknown function of the file /admin/uploads/. The manipulation leads to file and directory information exposure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249504.

Weakness: CWE-538

Which versions are affected by CVE-2024-0191?

It affects 1 product.

Products include Nia Rrj Nueva Ecija Engineer Online Portal.

How do I fix CVE-2024-0191?

No fix has been published for CVE-2024-0191 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-0191 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-0191 exists.

Sources

Also known as GHSA-w9r4-6f5q-p5h9.