PT-2024-2870 · Eclipse+1 · Jetty+1

Evan Grant · Published 2024-03-04 · Updated 2024-05-10 · CVE-2024-31851

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:N/C:C/I:P/A:P

Name of the Vulnerable Software and Affected Versions CData Sync versions prior to 23.4.8843

Description A path traversal vulnerability exists in the Java version of CData Sync when running using the embedded Jetty server. This issue is related to errors in handling relative paths to directories. Exploitation of this vulnerability could allow a remote attacker to gain unauthorized access to protected information and perform limited actions in the system by sending specially crafted HTTP requests.

Recommendations For versions prior to 23.4.8843, update to version 23.4.8843 or later to resolve the issue. As a temporary workaround, consider restricting access to the embedded Jetty server to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2024-03031

CVE-2024-31851

Affected Products

Cdata Sync

Jetty

References · 10

• https://bdu.fstec.ru/vul/2024-03031 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-31851 · Security Note
• https://safe-surf.ru/upload/VULN-new/VULN.2024-04-12.1.pdf · Security Note
• https://twitter.com/the_yellow_fall/status/1777188706392363082 · Twitter Post
• https://t.me/cybersecuritytechnologies/10480 · Telegram Post
• https://twitter.com/CVEnew/status/1776306954601742557 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1776348334753542508 · Twitter Post
• https://cdata.com/kb/entries/jetty-cve-0324.rst · Note
• https://twitter.com/fofabot/status/1787403853111136358 · Twitter Post
• https://tenable.com/security/research/tra-2024-09 · Note