CVE-2024-31841

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in Italtel Embrace 1.6.4. The web server fails to sanitize input data, allowing remote unauthenticated attackers to read arbitrary files on the filesystem.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Apr 19, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-318428.8An issue was discovered in Italtel Embrace 1.6.4. The web application inserts the access token of an authenticated user inside GET requests.CVE-2024-318434.1An issue was discovered in Italtel Embrace 1.6.4. The Web application does not properly check the parameters sent as input before they are p CVE-2024-318445.3An issue was discovered in Italtel Embrace 1.6.4. The server does not properly handle application errors. In some cases, this leads to a dis CVE-2024-318455.3An issue was discovered in Italtel Embrace 1.6.4. The product does not neutralize or incorrectly neutralizes output that is written to logs.CVE-2024-318467.5An issue was discovered in Italtel Embrace 1.6.4. The web application does not restrict or incorrectly restricts access to a resource from a CVE-2024-318476.1An issue was discovered in Italtel Embrace 1.6.4. A stored cross-site scripting (XSS) vulnerability allows authenticated and unauthenticated CVE-2024-318489.8A path traversal vulnerability exists in the Java version of CData API Server < 23.4.8844 when running using the embedded Jetty server, whic CVE-2024-318499.8A path traversal vulnerability exists in the Java version of CData Connect < 23.4.8846 when running using the embedded Jetty server, which c CVE-2024-31856.8A key used in logging.json does not follow the least privilege principle by default and is exposed to local users in the Rapid7 Platform. T CVE-2024-318508.6A path traversal vulnerability exists in the Java version of CData Arc < 23.4.8839 when running using the embedded Jetty server, which could CVE-2024-318518.6A path traversal vulnerability exists in the Java version of CData Sync < 23.4.8843 when running using the embedded Jetty server, which coul CVE-2024-318525.9LLVM before 18.1.3 generates code in which the LR register can be overwritten without data being saved to the stack, and thus there can some