CVE-2024-31947

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-07-12 · updated 2026-06-17
Weakness: CWE-22

Description

StoneFly Storage Concentrator (SC and SCVM) before 8.0.4.26 allows Directory Traversal by authenticated users. Using a crafted path parameter with the Online Help facility can expose sensitive system information.

Affected products

StoneFly Storage Concentrator: before 8.0.4.26 — fixed in 8.0.4.26

How to fix

Upgrade to a fixed version: StoneFly Storage Concentrator 8.0.4.26. Check the vendor advisory for mitigations.

References

https://stonefly.com
https://stonefly.com/security-advisories/cve-2024-31947/
https://stonefly.com
https://stonefly.com/security-advisories/cve-2024-31947/

Get alerted when CVE-2024-31947 or the next vulnerability affects your stack