Description

Multiple CData products have a path traversal vulnerability, when running using the embedded Jetty server. An unauthenticated attacker can bypass the authentication with a specially crafted HTTP request and get access to sensitive information and some administrative endpoints of the system.

Remediation

Upgrade to the latest version of CData software

References

Jetty Security Notice Overview

Path Traversal Affecting Multiple CData Products

Related Vulnerabilities

Oracle Database Server CVE-2008-1821 Vulnerability (CVE-2008-1821)

SharePoint CVE-2023-33159 Vulnerability (CVE-2023-33159)

MySQL CVE-2019-2482 Vulnerability (CVE-2019-2482)

TYPO3 Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2014-3942)

TYPO3 Permissions, Privileges, and Access Controls Vulnerability (CVE-2008-2717)

Severity

Critical

Classification

CVE-2024-31848 CVE-2024-31849 CVE-2024-31850 CVE-2024-31851 CWE-22 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Tags

Directory Traversal Authentication Bypass Known Vulnerabilities