ATISoluciones CIGES Application Sensitive Information Disclosure Vulnerability

A vulnerability allowing sensitive information disclosure exists in the error handling component of ATISoluciones CIGES Application versions through 2.15.6. The issue arises when certain unexpected conditions lead to unhandled exceptions, causing the application to return detailed error messages and stack traces to the client. This behavior may expose internal filesystem paths, SQL queries, database connection details, or environment configuration data to remote unauthenticated attackers. While this vulnerability facilitates information gathering and reconnaissance, it does not allow for direct system compromise.

Impact

Exploitation of this vulnerability could lead to unauthorized disclosure of sensitive information, including internal filesystem paths, SQL queries, database connection details, and environment configuration data.

Remediation

Users can upgrade to ATISoluciones CIGES Application version 2.15.7 to address this vulnerability.