An unauthenticated information disclosure vulnerability in the Manacle Technologies Multi-tenant ERP System allows attackers to reconstruct source code by accessing an exposed .git directory.

This vulnerability, classified as CWE-527, occurs when a version control repository directory is left publicly accessible on a web server. An unauthenticated remote attacker can download the entire .git folder, which allows them to reconstruct the application source code and gain insights into system architecture and potential further vulnerabilities.

The CVSS score of 9.2 highlights the severe impact of source code exposure. Access to the full repository allows an attacker to conduct sophisticated static analysis offline, identifying hidden backdoors, hardcoded credentials, or further logic flaws, which significantly increases the risk of a targeted and successful follow-up attack.

Immediate Action: Contact the vendor to obtain the necessary patch and ensure that all .git directories are removed from the production web server.

Proactive Monitoring: Use automated scanners to detect exposed sensitive files or directories on your web-facing infrastructure.

Compensating Controls: Configure web server permissions (e.g., in .htaccess or Nginx configuration) to explicitly deny access to any directory named .git.

Public Exploit Available: Unknown

System administrators must verify that no version control metadata is accessible via the web. Apply the vendor patch as soon as it is available and implement strict server configuration standards to prevent the accidental exposure of sensitive development files in production environments.