Description

Multiple CData products have a path traversal vulnerability, when running using the embedded Jetty server. An unauthenticated attacker can bypass the authentication with a specially crafted HTTP request and get access to sensitive information and some administrative endpoints of the system.

Remediation

Upgrade to the latest version of CData software

References

Jetty Security Notice Overview

Path Traversal Affecting Multiple CData Products

Related Vulnerabilities

PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2016-4543)

Grafana Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-11110)

Liferay DXP Inefficient Regular Expression Complexity Vulnerability (CVE-2022-42124)

MySQL CVE-2016-0594 Vulnerability (CVE-2016-0594)

WordPress Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2008-0491)

Severity

Critical

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Tags

Directory Traversal Authentication Bypass Known Vulnerabilities CWE-22 CVE-2024-31848 CVE-2024-31849 CVE-2024-31850 CVE-2024-31851