CVE-2024-1459

A path traversal vulnerability was found in Undertow. This issue may allow a remote attacker to append a specially-crafted sequence to an HTTP request for an application deployed to JBoss EAP, which may permit access to privileged or restricted files and directories.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
redhatCNA
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CISA-ADPADP
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 90%
VendorProductVersion
redhatundertow
-
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
undertow
forky
2.3.20-1
fixed
sid
2.3.20-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
undertow
questing
needs-triage
plucky
needs-triage
oracular
ignored
noble
needs-triage
mantic
dne
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
xenial
needs-triage
trusty
dne
Common Weakness Enumeration
References
https://access.redhat.com/errata/RHSA-2024:1674
https://access.redhat.com/errata/RHSA-2024:1675
https://access.redhat.com/errata/RHSA-2024:1676
https://access.redhat.com/errata/RHSA-2024:2763
https://access.redhat.com/errata/RHSA-2024:2764
https://access.redhat.com/security/cve/CVE-2024-1459
https://bugzilla.redhat.com/show_bug.cgi?id=2259475
https://access.redhat.com/errata/RHSA-2024:1677
https://access.redhat.com/errata/RHSA-2024:2763
https://access.redhat.com/errata/RHSA-2024:2764
https://access.redhat.com/security/cve/CVE-2024-1459
https://bugzilla.redhat.com/show_bug.cgi?id=2259475
https://security.netapp.com/advisory/ntap-20241122-0008/