PT-2024-2869 · Eclipse+1 · Jetty+1

Evan Grant · Published 2024-03-04 · Updated 2024-05-10 · CVE-2024-31850

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:N/C:C/I:P/A:P

Name of the Vulnerable Software and Affected Versions CData Arc versions prior to 23.4.8839

Description A path traversal vulnerability exists in the Java version of CData Arc when running using the embedded Jetty server. This could allow an unauthenticated remote attacker to gain access to sensitive information and perform limited actions by sending specially crafted HTTP requests. The vulnerability is related to errors in handling relative path to directory.

Recommendations For versions prior to 23.4.8839, update to version 23.4.8839 or later to resolve the issue. As a temporary workaround, consider restricting access to the embedded Jetty server until a patch is available. Avoid using the vulnerable server for sensitive operations until the issue is resolved.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2024-03030

CVE-2024-31850

Affected Products

Cdata Arc

Jetty

References · 10

• https://bdu.fstec.ru/vul/2024-03030 · Security Note
• https://safe-surf.ru/upload/VULN-new/VULN.2024-04-12.1.pdf · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-31850 · Security Note
• https://twitter.com/the_yellow_fall/status/1777188706392363082 · Twitter Post
• https://t.me/cybersecuritytechnologies/10480 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1776351118248829165 · Twitter Post
• https://cdata.com/kb/entries/jetty-cve-0324.rst · Note
• https://twitter.com/fofabot/status/1787403853111136358 · Twitter Post
• https://tenable.com/security/research/tra-2024-09 · Note
• https://twitter.com/CVEnew/status/1776306955725705296 · Twitter Post