CVE-2024-0490 is a medium severity information exposure vulnerability in Huaxia ERP up to and including 3.1, scored CVSS 5.3. It affects /user/getAllList. The record says upgrading to 3.2 addresses it.
What's affected
The record names Huaxia ERP, version up to and including 3.1. The weakness is tracked as CWE-200. The affected code is /user/getAllList. The record says the issue can be reached remotely and that an exploit has been disclosed publicly. It was published on 2024-01-13 and the VulDB identifier is VDB-250595.
The record says upgrading to version 3.2 addresses the issue. Confirm that against the vendor or project release notes before you rely on it.
How to check if you're exposed
Start with an inventory question: do you run Huaxia ERP at all? These are small standalone web applications, so they rarely show up in a package manager. Look for them as deployed source trees, not as installed packages. Check web roots, shared hosting accounts, internal tools servers and any container images built from a download of the project.
If you find a copy, confirm the version. The record lists up to and including 3.1. Then confirm that /user/getAllList exists in your tree. A command like this, run from the server or a checked out copy, will show whether the file is present:
grep -rn "huaxia\|jsh-erp\|jshERP" /srv /opt --include=pom.xml
If the file is present, assume the copy is affected until you have evidence otherwise. We have not seen a vendor advisory that describes a detection method, so there is no official check to point you to. Review the application's access logs for requests to that path from unexpected sources, and compare against normal use. Unusual or failing requests to a single page are worth a closer look. A log review cannot prove a copy was not abused, but it can help you scope the review.
Dependency scanners will not find a standalone application like this by itself. You can still use the free in-browser dependency scan at gold.safeguard.sh/scan on any project that vendors it as a library, and the Gold directory entry for CVE-2024-0490 tracks the record as it changes.
What to do now
- Find every deployed copy of Huaxia ERP, including test and staging servers and forgotten hosting accounts.
- Record the version of each copy. The record covers up to and including 3.1.
- Plan the upgrade to version 3.2 named in the record, and read the project release notes first to confirm what else changes.
- If the application does not need to be reachable from the internet, move it behind a VPN or an allow list of known addresses now.
- Limit what the affected page returns and who can call it, and make sure database or system error detail never reaches the browser.
- If you cannot patch and the software is not essential, plan to retire or replace it. Unmaintained sample style projects are poor candidates for holding real data.
Why it matters
Information exposure covers cases where an application hands data to someone who should not have it. The record describes the effect as information disclosure and gives no detail about which fields or tables are involved, so impact depends on what the affected page can reach in your deployment. Both this record and its sibling CVE-2024-0491 were filed against the same product in the same week.
A note on severity. The record's description text, taken from the VulDB entry, calls this issue problematic. The CVSS 3.1 base score attached to the record is 5.3, which is medium, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. Both are accurate descriptions of the same record, and they use different scales. For triage we use the CVSS score and the exposure of your own deployment. VulDB publishes its own scoring, which we could not retrieve.
CVE-2024-0490 is not on the CISA Known Exploited Vulnerabilities list. The description does say the exploit has been disclosed to the public and may be used, which means the technical detail is available to anyone who looks. That is a reason to act on exposed copies, even though no exploitation is recorded in the sources we could read.
Quick check
Is CVE-2024-0490 known to be exploited in the wild?
It is not on the CISA Known Exploited Vulnerabilities list, and the sources we could read do not report exploitation. The description does say a public exploit exists, so do not wait for confirmation.
Is there a fixed version of Huaxia ERP?
The record says upgrading to version 3.2 addresses it. Check the project release notes to confirm.
Sources
- Gold entry for CVE-2024-0490
- NVD record for CVE-2024-0490, including the VulDB entry VDB-250595, as summarized in the Safeguard record file (we could not load the VulDB page or the linked researcher write up, so details beyond the record are not confirmed)
Last reviewed: 19 October 2026.
