Login Request a demo
Medium severity · published Feb 12, 2024
CVE-2024-1459
A path traversal vulnerability was found in Undertow
5.3
CVSS
1.7%
EPSS
No
On KEV
Description
A path traversal vulnerability was found in Undertow. This issue may allow a remote attacker to append a specially-crafted sequence to an HTTP request for an application deployed to JBoss EAP, which may permit access to privileged or restricted files and directories.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UN
Undertow · Redhat
All versions, or not specified · source: NVD
Affected product
UN
Undertow
Redhat
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-1459
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-1459
access.redhat.com
https://access.redhat.com/errata/RHSA-2024:1674
access.redhat.com
https://access.redhat.com/errata/RHSA-2024:1675
access.redhat.com
https://access.redhat.com/errata/RHSA-2024:1676
access.redhat.com
https://access.redhat.com/errata/RHSA-2024:2763
access.redhat.com
https://access.redhat.com/errata/RHSA-2024:2764
Vendor Advisory
https://access.redhat.com/security/cve/CVE-2024-1459
More from Undertow
9.8
CVE-2020-1745
A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before and was fixed in…
9.8
CVE-2019-10212
A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security
9.8
CVE-2019-3888
A vulnerability was found in Undertow web server before 2.0.21
9.6
CVE-2025-12543
Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf
9.1
CVE-2026-28369
Undertow: undertow: request smuggling via malformed http request headers