CVE-2024-31850
 
Severity Score
8.6
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
1
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Attend
*SSVC
Descriptions
A path traversal vulnerability exists in the Java version of CData Arc < 23.4.8839 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain access to sensitive information and perform limited actions.
Existe una vulnerabilidad de path traversal en la versión Java de CData Arc < 23.4.8839 cuando se ejecuta utilizando el servidor Jetty integrado, lo que podría permitir que un atacante remoto no autenticado obtenga acceso a información confidencial y realice acciones limitadas.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Attend
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2024-04-05 CVE Reserved
- 2024-04-05 CVE Published
- 2024-05-07 First Exploit
- 2024-08-26 CVE Updated
- 2024-11-22 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CAPEC
- CAPEC-115: Authentication Bypass
References (2)
URL | Tag | Source |
---|---|---|
https://www.tenable.com/security/research/tra-2024-09 |
URL | Date | SRC |
---|---|---|
https://github.com/Stuub/CVE-2024-31848-PoC | 2024-05-07 |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
CData Search vendor "CData" | Arc Search vendor "CData" for product "Arc" | < 23.4.8839 Search vendor "CData" for product "Arc" and version " < 23.4.8839" | en |
Affected
|