GitHub Advisoryadvisory · Maven
GHSA-v76w-3ph8-vm66 Undertow Path Traversal vulnerability
MEDIUM
Official page ↗
- Aliases
- CVE-2024-1459
- Ecosystem
- Maven
- Packages
- io.undertow:undertow-core
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-24
- Reviewed
- 2024-04-15
Affected packages
• Maven io.undertow:undertow-core: < 2.2.31.Final → fixed in 2.2.31.Final
• Maven io.undertow:undertow-core: >= 2.3.0.Alpha1, < 2.3.12.Final → fixed in 2.3.12.Final
Description
A path traversal vulnerability was found in Undertow. This issue may allow a remote attacker to append a specially-crafted sequence to an HTTP request for an application deployed to JBoss EAP, which may permit access to privileged or restricted files and directories.
Related
Alias · CVE (1)
- CVE-2024-1459 A path traversal vulnerability was found in Undertow. vulnerability
Weakness · CWE (1)
- CWE-24 Path Traversal: '../filedir' weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-1459 advisory
- https://github.com/undertow-io/undertow/pull/1556 web
- https://github.com/undertow-io/undertow/commit/40bb3314f013247af8e222870bd5045ca8650c5c web
- https://github.com/undertow-io/undertow/commit/54f3e4325425c472f5af5fc973e02df83d7a711a web
- https://access.redhat.com/errata/RHSA-2024:1674 web
- https://access.redhat.com/errata/RHSA-2024:1675 web
- https://access.redhat.com/errata/RHSA-2024:1676 web
- https://access.redhat.com/errata/RHSA-2024:1677 web
- https://access.redhat.com/errata/RHSA-2024:2763 web
- https://access.redhat.com/errata/RHSA-2024:2764 web
- https://access.redhat.com/security/cve/CVE-2024-1459 web
- https://bugzilla.redhat.com/show_bug.cgi?id=2259475 web
- https://issues.redhat.com/browse/UNDERTOW-2339 web
- https://security.netapp.com/advisory/ntap-20241122-0008 web