{"id":"CVE-2024-31849","aliases":["EUVD-2024-29719","GHSA-f3hc-9q6r-j846"],"status":"published","title":"A path traversal vulnerability exists in the Java version of CData Connect \u003c 23.4.8846 when...","description":"A path traversal vulnerability exists in the Java version of CData Connect \u003c 23.4.8846 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain complete administrative access to the application.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.06076,"percentile":0.93497,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2024-04-05T17:40:54Z","modified":"2026-06-17T07:28:49Z","exploits":[{"source":"nuclei","id":"CVE-2024-31849","title":"CData Connect \u003c 23.4.8846 - Path Traversal","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-31849.yaml"}],"products":[{"vendor":"cdata","product":"connect"},{"vendor":"tanium","product":"connect"}],"references":[{"url":"https://www.tenable.com/security/research/tra-2024-09","tags":["x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-31849"},{"url":"https://github.com/advisories/GHSA-f3hc-9q6r-j846"}],"sources":{"cve":[{"id":"CVE-2024-31849","description":"A path traversal vulnerability exists in the Java version of CData Connect \u003c 23.4.8846 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain complete administrative access to the application.","status":"published","published":"2024-04-05T17:40:54.797Z","modified":"2024-08-02T01:59:50.072Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:34:14.308905Z"}],"euvd":[{"id":"EUVD-2024-29719","description":"A path traversal vulnerability exists in the Java version of CData Connect \u003c 23.4.8846 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain complete administrative access to the application.","status":"published","published":"2024-04-05T17:40:54Z","modified":"2024-08-02T01:59:50Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T03:50:23.537508Z"}],"ghsa":[{"id":"GHSA-f3hc-9q6r-j846","title":"A path traversal vulnerability exists in the Java version of CData Connect \u003c 23.4.8846 when...","description":"A path traversal vulnerability exists in the Java version of CData Connect \u003c 23.4.8846 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain complete administrative access to the application.","status":"published","published":"2024-04-05T18:30:35Z","modified":"2024-04-05T18:30:35Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:57:03.777371Z"}],"nvd":[{"id":"CVE-2024-31849","description":"A path traversal vulnerability exists in the Java version of CData Connect \u003c 23.4.8846 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain complete administrative access to the application.","status":"published","published":"2024-04-05T18:15:09.563Z","modified":"2026-06-17T07:28:49.923Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:09:48.152273Z"}]}}