CVE-2024-2634

Name of the Vulnerable Software and Affected Versions Meta4 HR versions 819.001.022 and earlier

Description A Cross-Site Scripting issue has been identified. The endpoint "/sse generico/generico login.jsp" is vulnerable to attack via the lang query. For example, the URL "/sse generico/generico login.jsp?lang=%27%3balert(%27BLEUSS%27)%2f%2f&params=" can be used to exploit this issue.

Recommendations For Meta4 HR versions 819.001.022 and earlier, as a temporary workaround, consider restricting access to the "/sse generico/generico login.jsp" endpoint until a patch is available. Avoid using the lang query parameter in this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.