CVE-2024-8510 - Vulnerability Details - OpenCVE

N-central is vulnerable to a path traversal that allows unintended access to the Apache Tomcat WEB-INF directory. Customer data is not exposed. This vulnerability is present in all deployments of N-central prior to N-central 2024.6.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2024.6_Release_Notes.htm
https://me.n-able.com/s/security-advisory/aArVy0000000XgjKAE/cve20248510-ncentral-path-traversal

History

Tue, 18 Mar 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 17 Mar 2025 19:15:00 +0000

Type	Values Removed	Values Added
Description		N-central is vulnerable to a path traversal that allows unintended access to the Apache Tomcat WEB-INF directory. Customer data is not exposed. This vulnerability is present in all deployments of N-central prior to N-central 2024.6.
Title		N-central Path Traversal
Weaknesses		CWE-22 CWE-23
References		https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2024.6_Release_Notes.htm https://me.n-able.com/s/security-advisory/aArVy0000000XgjKAE/cve20248510-ncentral-path-traversal
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: N-able

Published: 2025-03-17T19:01:36.361Z

Updated: 2025-03-18T14:41:47.223Z

Reserved: 2024-09-06T12:54:48.767Z

Link: CVE-2024-8510

Vulnrichment

Updated: 2025-03-18T14:41:43.384Z

NVD

Status : Received

Published: 2025-03-17T19:15:25.120

Modified: 2025-03-17T19:15:25.120

Link: CVE-2024-8510

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-8510", "assignerOrgId": "a5532a13-c4dd-4202-bef1-e0b8f2f8d12b", "state": "PUBLISHED", "assignerShortName": "N-able", "dateReserved": "2024-09-06T12:54:48.767Z", "datePublished": "2025-03-17T19:01:36.361Z", "dateUpdated": "2025-03-18T14:41:47.223Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "N-central", "vendor": "N-able", "versions": [{"lessThan": "2024.6", "status": "affected", "version": "0", "versionType": "date"}]}], "datePublic": "2025-03-17T19:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "N-central is vulnerable to a path traversal that allows unintended access to the Apache Tomcat WEB-INF directory. Customer data is not exposed. <br><br>This vulnerability is present in all deployments of N-central prior to N-central 2024.6.<br>"}], "value": "N-central is vulnerable to a path traversal that allows unintended access to the Apache Tomcat WEB-INF directory. Customer data is not exposed. \n\nThis vulnerability is present in all deployments of N-central prior to N-central 2024.6."}], "impacts": [{"capecId": "CAPEC-139", "descriptions": [{"lang": "en", "value": "CAPEC-139 Relative Path Traversal"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-23", "description": "CWE-23: Relative Path Traversal", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "a5532a13-c4dd-4202-bef1-e0b8f2f8d12b", "shortName": "N-able", "dateUpdated": "2025-03-17T19:01:36.361Z"}, "references": [{"url": "https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2024.6_Release_Notes.htm"}, {"url": "https://me.n-able.com/s/security-advisory/aArVy0000000XgjKAE/cve20248510-ncentral-path-traversal"}], "source": {"discovery": "UNKNOWN"}, "title": "N-central Path Traversal", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-18T14:41:37.627072Z", "id": "CVE-2024-8510", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-18T14:41:47.223Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-8510", "assignerOrgId": "a5532a13-c4dd-4202-bef1-e0b8f2f8d12b", "state": "PUBLISHED", "assignerShortName": "N-able", "dateReserved": "2024-09-06T12:54:48.767Z", "datePublished": "2025-03-17T19:01:36.361Z", "dateUpdated": "2025-03-18T14:41:47.223Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "N-central", "vendor": "N-able", "versions": [{"lessThan": "2024.6", "status": "affected", "version": "0", "versionType": "date"}]}], "datePublic": "2025-03-17T19:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "N-central is vulnerable to a path traversal that allows unintended access to the Apache Tomcat WEB-INF directory. Customer data is not exposed. <br><br>This vulnerability is present in all deployments of N-central prior to N-central 2024.6.<br>"}], "value": "N-central is vulnerable to a path traversal that allows unintended access to the Apache Tomcat WEB-INF directory. Customer data is not exposed. \n\nThis vulnerability is present in all deployments of N-central prior to N-central 2024.6."}], "impacts": [{"capecId": "CAPEC-139", "descriptions": [{"lang": "en", "value": "CAPEC-139 Relative Path Traversal"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-23", "description": "CWE-23: Relative Path Traversal", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "a5532a13-c4dd-4202-bef1-e0b8f2f8d12b", "shortName": "N-able", "dateUpdated": "2025-03-17T19:01:36.361Z"}, "references": [{"url": "https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2024.6_Release_Notes.htm"}, {"url": "https://me.n-able.com/s/security-advisory/aArVy0000000XgjKAE/cve20248510-ncentral-path-traversal"}], "source": {"discovery": "UNKNOWN"}, "title": "N-central Path Traversal", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-8510", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-18T14:41:37.627072Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-18T14:41:43.384Z"}}]}}