CVE-2024-31851

HIGHNuclei

CData Sync < 23.4.8843 - Path Traversal

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2024-31851 has a selected CVSS score of 8.6 (high); EIP currently links 1 Nuclei template.

Description

A path traversal vulnerability exists in the Java version of CData Sync < 23.4.8843 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain access to sensitive information and perform limited actions.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 5, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Sync

Browse CData / Sync

Default status: unaffected, unknown

CVE ListBefore 23.4.8843affected

Nuclei templates

1
ProjectDiscoveryHIGHCData Sync < 23.4.8843 - Path TraversalCVSS 8.6

A path traversal vulnerability exists in the Java version of CData Sync < 23.4.8843 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain access to sensitive information and perform limited actions.

Impact

Unauthenticated attackers can access sensitive information and perform limited unauthorized actions via path traversal.

Remediation

Update CData Sync to version 23.4.8843 or later.

WeaknessesCWE-22
AuthorsDhiyaneshDK
Template tagscvecve2024cdatalfivuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Shodan: title:"CData Sync"
https://www.tenable.com/security/research/tra-2024-09 https://nvd.nist.gov/vuln/detail/CVE-2024-31851

Source: ProjectDiscovery

References

2