This vulnerability in Efí Bank's Gerencianet Oficial product allows an attacker to insert sensitive information into data sent by the application, which can then be retrieved. The issue affects versions up to and including 3.1.3. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates that the attack can be performed remotely without authentication or user interaction, with low complexity, and results in limited confidentiality impact without affecting integrity or availability.

An attacker exploiting this vulnerability could retrieve sensitive information embedded in sent data, potentially leading to unauthorized disclosure of confidential information. The impact is limited to confidentiality with no direct effect on data integrity or system availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Users should monitor Efí Bank's advisories for updates and apply any official patches once released. Until then, consider limiting exposure of the affected product to untrusted networks if feasible.