CVE-2024-2636 Multiple vulnerabilities on Meta4 HR from Cegid
Attackers can upload malicious JSP files via the password update endpoint to execute arbitrary code on the server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-2636?
CVE-2024-2636 is a critical vulnerability in Cegid Meta4 HR, published on 19 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An Unrestricted Upload of File vulnerability has been found on Cegid Meta4 HR, that allows an attacker to upload malicios files to the server via '/config/espanol/update_password.jsp' file. Modifying the 'M4_NEW_PASSWORD' parameter, an attacker could store a malicious JSP file inside the file directory, to be executed the the file is loaded in the application.
Weakness: CWE-434
Which versions are affected by CVE-2024-2636?
How do I fix CVE-2024-2636?
No fix has been published for CVE-2024-2636 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-2636 being exploited?
There is no known exploitation of CVE-2024-2636 in the wild and no public exploit code.
Sources
Also known as GHSA-6gp7-8ggq-x9c3.