Metasoft MetaCRM Information Disclosure Vulnerability in env.jsp

A vulnerability allowing information disclosure has been identified in Metasoft MetaCRM versions through 6.4.2. The issue resides in the env.jsp file, where sensitive information such as the server name, Java version, and absolute file paths can be accessed. This vulnerability can be exploited remotely without authentication.

Impact

Exploitation of this vulnerability allows unauthorized access to sensitive server information, which could be used for further attacks or to compromise the server.

Reproduction

The vulnerability can be reproduced by sending a request to the /env.jsp endpoint without authentication. This can be done manually or through automated tools. The absence of authentication controls allows unauthorized users to access sensitive information.