A high-severity information disclosure vulnerability in MCMS v.6.1.1 allows unauthenticated remote attackers to access sensitive data.

The application is susceptible to sensitive information disclosure due to improper validation of the source parameter. This vulnerability is remotely exploitable by an unauthenticated attacker without requiring user interaction.

With a CVSS score of 7.5, this vulnerability represents a significant risk to data confidentiality. Unauthorized access to sensitive information can lead to severe reputational damage, regulatory non-compliance, and the exposure of proprietary or private user data stored within the system.

Immediate Action: Since no specific patch version is currently identified, verify with the vendor for the latest security release and apply it immediately.

Proactive Monitoring: Monitor server logs for suspicious requests involving the source parameter that appear to be attempting to traverse directories or access unauthorized files.

Compensating Controls: Implement input validation rules at the network perimeter or via a WAF to restrict or sanitize the source parameter, preventing unauthorized data retrieval attempts.

Public Exploit Available: No

Organizations utilizing MCMS v.6.1.1 should treat this as a high-priority item. In the absence of a confirmed patch, users should restrict network access to the application to trusted sources only and monitor for any attempts to probe the source parameter.