Pedro Jose Navas Pérez

**Name of the Vulnerable Software and Affected Versions** Meta4 HR (affected versions not specified) **Description** A vulnerability has been found that allows an attacker to obtain information about the application, including variables set in the process, Tomcat versions, library versions, and the underlying operating system. This is achieved via the HTTP GET endpoint "/sitetest/english/dumpenv.jsp". **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Meta4 HR versions 819.001.022 and earlier **Description** A Cross-Site Scripting issue has been identified. The endpoint "/sitetest/english/dumpenv.jsp" is vulnerable to an XSS attack via the `lang` query. For example, the URL "/sitetest/english/dumpenv.jsp?snoop=yes&lang=%27%3Cimg%20src/onerror=alert(1)%3E&params" demonstrates this vulnerability. **Recommendations** For Meta4 HR versions 819.001.022 and earlier, as a temporary workaround, consider restricting access to the "/sitetest/english/dumpenv.jsp" endpoint until a patch is available. Avoid using the `lang` query parameter in this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Meta4 HR versions 819.001.022 and earlier **Description** A Cross-Site Scripting issue has been identified. The endpoint "/sse generico/generico login.jsp" is vulnerable to attack via the `lang` query. For example, the URL "/sse generico/generico login.jsp?lang=%27%3balert(%27BLEUSS%27)%2f%2f&params=" can be used to exploit this issue. **Recommendations** For Meta4 HR versions 819.001.022 and earlier, as a temporary workaround, consider restricting access to the "/sse generico/generico login.jsp" endpoint until a patch is available. Avoid using the `lang` query parameter in this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.