CData Vulnerabilities and Affected Products
Vulnerabilities associated with API Server.
Products
Clear product- API Server2 vulnerabilities
- api_server1 vulnerability
- Arc1 vulnerability
- Connect1 vulnerability
- Sync1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2025-9273MEDIUM | CData API Server MySQL Misconfiguration Information Disclosure VulnerabilityCData API Server MySQL Misconfiguration Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of CData API Server. Authentication is required to exploit this vulnerability. The specific flaw exists within the usage of MySQL connections. When connecting to a MySQL server, the product enables an option that gives the MySQL server permission to request local files from the MySQL client. An attacker can leverage … CWE-552Sep 2, 2025 | CVSS4.3v3.0 | EPSS0.381% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-31848CRITICAL | CData API Server < 23.4.8844 - Path TraversalA path traversal vulnerability exists in the Java version of CData API Server < 23.4.8844 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain complete administrative access to the application. | CVSS9.8v3.1 | EPSS8.09% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |