CVE-2024-31844

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An issue was discovered in Italtel Embrace 1.6.4. The server does not properly handle application errors. In some cases, this leads to a disclosure of information about the server. An unauthenticated user is able craft specific requests in order to make the application generate an error. Inside an error message, some information about the server is revealed, such as the absolute path of the source code of the application. This kind of information can help an attacker to perform other attacks against the system. This can be exploited without authentication.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-209

Affected software

No affected versions have been published.

Timeline

Published: May 21, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-318455.3An issue was discovered in Italtel Embrace 1.6.4. The product does not neutralize or incorrectly neutralizes output that is written to logs.CVE-2024-318467.5An issue was discovered in Italtel Embrace 1.6.4. The web application does not restrict or incorrectly restricts access to a resource from a CVE-2024-318476.1An issue was discovered in Italtel Embrace 1.6.4. A stored cross-site scripting (XSS) vulnerability allows authenticated and unauthenticated CVE-2024-318489.8A path traversal vulnerability exists in the Java version of CData API Server < 23.4.8844 when running using the embedded Jetty server, whic CVE-2024-318499.8A path traversal vulnerability exists in the Java version of CData Connect < 23.4.8846 when running using the embedded Jetty server, which c CVE-2024-31856.8A key used in logging.json does not follow the least privilege principle by default and is exposed to local users in the Rapid7 Platform. T CVE-2024-318508.6A path traversal vulnerability exists in the Java version of CData Arc < 23.4.8839 when running using the embedded Jetty server, which could CVE-2024-318518.6A path traversal vulnerability exists in the Java version of CData Sync < 23.4.8843 when running using the embedded Jetty server, which coul CVE-2024-318525.9LLVM before 18.1.3 generates code in which the LR register can be overwritten without data being saved to the stack, and thus there can some CVE-2024-318538.1A vulnerability has been identified in SICAM TOOLBOX II (All versions < V07.11). During establishment of a https connection to the TLS serve CVE-2024-318548.1A vulnerability has been identified in SICAM TOOLBOX II (All versions < V07.11). During establishment of a https connection to the TLS serve CVE-2024-318568.8An attacker with certain MQTT permissions can create malicious messages to all CyberPower PowerPanel devices. This could result in an attac