CVE-2024-31848

Summary

CVE-2024-31848 is a newly disclosed vulnerability affecting the Java version of CData API Server below 23.4.8844 when run with the embedded Jetty server. This issue involves a path traversal vulnerability, enabling unauthenticated remote attackers to gain complete administrative access to the application. By manipulating the file path during data requests, attackers can potentially bypass security restrictions and access sensitive data or execute malicious code. This vulnerability poses a significant risk, as it allows attackers to gain unauthorized control over the server. Users are strongly urged to update their CData API Server to the latest version to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.