PT-2024-2868 · Eclipse+1 · Jetty+1

Evan Grant · Published 2024-03-04 · Updated 2024-05-10 · CVE-2024-31849

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions CData Connect versions prior to 23.4.8846

Description A path traversal vulnerability exists in the Java version of CData Connect when running using the embedded Jetty server. This could allow an unauthenticated remote attacker to gain complete administrative access to the application by sending specially crafted HTTP requests, potentially allowing them to elevate their privileges.

Recommendations For versions prior to 23.4.8846, update to version 23.4.8846 or later to resolve the issue. As a temporary workaround, consider restricting access to the embedded Jetty server until a patch is applied.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2024-03029

CVE-2024-31849

Affected Products

Cdata Connect

Jetty

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2024-31849 · Security Note
• https://safe-surf.ru/upload/VULN-new/VULN.2024-04-12.1.pdf · Security Note
• https://bdu.fstec.ru/vul/2024-03029 · Security Note
• https://twitter.com/the_yellow_fall/status/1777188706392363082 · Twitter Post
• https://t.me/cybersecuritytechnologies/10480 · Telegram Post
• https://twitter.com/CVEnew/status/1776306956749221999 · Twitter Post
• https://cdata.com/kb/entries/jetty-cve-0324.rst · Note
• https://twitter.com/fofabot/status/1787403853111136358 · Twitter Post
• https://tenable.com/security/research/tra-2024-09 · Note
• https://twitter.com/VulmonFeeds/status/1776350612034040206 · Twitter Post