CVE-2024-31848
Published: 05 April 2024
Summary
CVE-2024-31848 is a critical-severity Path Traversal (CWE-22) vulnerability. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
A path traversal vulnerability exists in the Java version of CData API Server versions prior to 23.4.8844 when running on the embedded Jetty server. Tracked as CVE-2024-31848 with CWE-22 and a CVSS 3.1 score of 9.8, the flaw stems from insufficient validation of file paths, allowing unauthorized traversal outside intended directories.
An unauthenticated remote attacker can exploit the issue over the network without credentials or user interaction to obtain complete administrative control of the application, resulting in full read, write, and execution capabilities on the server.
The Tenable advisory at https://www.tenable.com/security/research/tra-2024-09 details the affected component and confirms the path traversal vector. The associated EPSS score stands at 0.9360 with no material rise from a lower baseline.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-29718
Vulnerability details
A path traversal vulnerability exists in the Java version of CData API Server < 23.4.8844 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain complete administrative access to the application.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.