{"id":"CVE-2024-31848","aliases":["EUVD-2024-29718","GHSA-cjgj-qv8v-fhgh"],"status":"published","title":"A path traversal vulnerability exists in the Java version of CData API Server \u003c 23.4.8844 when...","description":"A path traversal vulnerability exists in the Java version of CData API Server \u003c 23.4.8844 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain complete administrative access to the application.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.08086,"percentile":0.9489,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-22"],"published":"2024-04-05T17:39:46Z","modified":"2026-06-17T07:28:49Z","exploits":[{"source":"nuclei","id":"CVE-2024-31848","title":"CData API Server \u003c 23.4.8844 - Path Traversal","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-31848.yaml"},{"source":"pocgithub","id":"Stuub/CVE-2024-31848-PoC","title":"Stuub/CVE-2024-31848-PoC","date":"2024-05-07","url":"https://github.com/Stuub/CVE-2024-31848-PoC"}],"products":[{"vendor":"cdata","product":"api server"},{"vendor":"cdata","product":"api_server"}],"references":[{"url":"https://www.tenable.com/security/research/tra-2024-09","tags":["x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-31848"},{"url":"https://github.com/advisories/GHSA-cjgj-qv8v-fhgh"}],"sources":{"cve":[{"id":"CVE-2024-31848","description":"A path traversal vulnerability exists in the Java version of CData API Server \u003c 23.4.8844 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain complete administrative access to the application.","status":"published","published":"2024-04-05T17:39:46.001Z","modified":"2024-08-02T01:59:50.069Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:34:14.308905Z"}],"euvd":[{"id":"EUVD-2024-29718","description":"A path traversal vulnerability exists in the Java version of CData API Server \u003c 23.4.8844 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain complete administrative access to the application.","status":"published","published":"2024-04-05T17:39:46Z","modified":"2024-08-02T01:59:50Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T03:50:23.537508Z"}],"ghsa":[{"id":"GHSA-cjgj-qv8v-fhgh","title":"A path traversal vulnerability exists in the Java version of CData API Server \u003c 23.4.8844 when...","description":"A path traversal vulnerability exists in the Java version of CData API Server \u003c 23.4.8844 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain complete administrative access to the application.","status":"published","published":"2024-04-05T18:30:35Z","modified":"2024-04-05T18:30:35Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:57:03.777371Z"}],"nvd":[{"id":"CVE-2024-31848","description":"A path traversal vulnerability exists in the Java version of CData API Server \u003c 23.4.8844 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain complete administrative access to the application.","status":"published","published":"2024-04-05T18:15:09.36Z","modified":"2026-06-17T07:28:49.823Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:09:48.152273Z"}]}}