Lucene search

TenableVULNRICHMENT:CVE-2024-31848

HistoryApr 05, 2024 - 5:39 p.m.

CVE-2024-31848

2024-04-0517:39:46

CWE-22

tenable

github.com

security

cve-2024-31848

java

cdata api

path traversal

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.2 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

22.0%

JSON

A path traversal vulnerability exists in the Java version of CData API Server < 23.4.8844 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain complete administrative access to the application.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "API Server",
    "vendor": "CData",
    "versions": [
      {
        "lessThan": "23.4.8844",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.tenable.com/security/research/tra-2024-09

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.2 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

22.0%

JSON

Related for VULNRICHMENT:CVE-2024-31848