CVE-2024-1459CWE-24

CVE-2024-1459

Medium · published February 13, 2024

CVSS v3.1
5.3
EPSS
2%
Percentile
77.2
In the wild
Unconfirmed
What it is

A path traversal vulnerability was found in Undertow. This issue may allow a remote attacker to append a specially-crafted sequence to an HTTP request for an application deployed to JBoss EAP, which may permit access to privileged or restricted files and directories.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01714 · 77.2th percentile
Weakness
CWE-24 · Path Traversal: '../filedir'
Published
2024-02-13T02:15Z
Affected products (1)
ProductVersionsFixed in
redhat/undertowall versions—
References (13)
https://access.redhat.com/errata/RHSA-2024:1674 · [email protected]https://access.redhat.com/errata/RHSA-2024:1675 · [email protected]https://access.redhat.com/errata/RHSA-2024:1676 · [email protected]https://access.redhat.com/errata/RHSA-2024:2763 · [email protected]https://access.redhat.com/errata/RHSA-2024:2764 · [email protected]https://access.redhat.com/security/cve/CVE-2024-1459 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2259475 · [email protected]https://access.redhat.com/errata/RHSA-2024:1677 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2024:2763 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2024:2764 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/security/cve/CVE-2024-1459 · af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=2259475 · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20241122-0008/ · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 12 FEB 20:30Z
    Undertow: directory traversal vulnerability
    cvelistv5