CVE-2024-31850
Published: 05 April 2024
Summary
CVE-2024-31850 is a high-severity Path Traversal (CWE-22) vulnerability. Its CVSS base score is 8.6 (High).
Operationally, ranked in the top 0.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
A path traversal vulnerability exists in the Java version of CData Arc prior to 23.4.8839 when running on the embedded Jetty server. Tracked as CVE-2024-31850 and assigned CWE-22, the flaw carries a CVSS 3.1 score of 8.6 and enables unauthorized access to sensitive information along with limited actions on the host.
An unauthenticated remote attacker can exploit the issue over the network with low attack complexity and no user interaction required, resulting in high confidentiality impact and limited integrity and availability consequences.
Reference material on the vulnerability is available from Tenable at https://www.tenable.com/security/research/tra-2024-09. The associated EPSS score has remained at a steady 0.8986.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-29720
Vulnerability details
A path traversal vulnerability exists in the Java version of CData Arc < 23.4.8839 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain access to sensitive information and perform limited actions.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.