CWE-527
Exposure of Version-Control Repository to an Unauthorized Control Sphere
Monthly
Source code disclosure in Manacle Technologies' Multi-Tenant ERP System allows unauthenticated remote attackers to reconstruct the application's source by downloading an exposed, web-accessible .git directory (CWE-527). Because the version-control metadata can be walked to recover full repository history, attackers can harvest hardcoded credentials, API keys, database schemas, and business logic that enable follow-on attacks. No public exploit or CISA KEV listing exists at this time, but .git exposure is trivially exploited with widely available off-the-shelf tooling.
`projen` is a project generation tool that synthesizes project configuration files such as `package.json`, `tsconfig.json`, `.gitignore`, GitHub Workflows, `eslint`, `jest`, and more, from a. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.
Source code disclosure in Manacle Technologies' Multi-Tenant ERP System allows unauthenticated remote attackers to reconstruct the application's source by downloading an exposed, web-accessible .git directory (CWE-527). Because the version-control metadata can be walked to recover full repository history, attackers can harvest hardcoded credentials, API keys, database schemas, and business logic that enable follow-on attacks. No public exploit or CISA KEV listing exists at this time, but .git exposure is trivially exploited with widely available off-the-shelf tooling.
`projen` is a project generation tool that synthesizes project configuration files such as `package.json`, `tsconfig.json`, `.gitignore`, GitHub Workflows, `eslint`, `jest`, and more, from a. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.