CVE-2024-1459
CVE-2024-1459 · Undertow: directory traversal vulnerability
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
A path traversal vulnerability was found in Undertow. This issue may allow a remote attacker to append a specially-crafted sequence to an HTTP request for an application deployed to JBoss EAP, which may permit access to privileged or restricted files and directories.
CVSS 5.3 · Medium · EPSS 1.7% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
red hat jboss enterprise application platform 7.4 for rhel 8
- Versions
- ≥ 0:2.16.0-18.redhat_00052.1.el8eap: Not affected (rpm)
No fix published
red hat jboss enterprise application platform 7.4 for rhel 8
- Versions
- ≥ 0:3.4.10-2.redhat_00001.1.el8eap: Not affected (rpm)
No fix published
red hat jboss enterprise application platform 7.4 for rhel 8
- Versions
- ≥ 0:5.13.3.202401111512-1.r_redhat_00001.1.el8eap: Not affected (rpm)
No fix published
red hat jboss enterprise application platform 7.4 for rhel 8
- Versions
- ≥ 0:1.9.4-1.Final_redhat_00001.1.el8eap: Not affected (rpm)
No fix published
red hat jboss enterprise application platform 7.4 for rhel 8
- Versions
- ≥ 0:3.3.21-1.Final_redhat_00001.1.el8eap: Not affected (rpm)
No fix published
red hat jboss enterprise application platform 7.4 for rhel 8
- Versions
- ≥ 0:5.3.36-1.Final_redhat_00001.1.el8eap: Not affected (rpm)
No fix published
red hat jboss enterprise application platform 7.4 for rhel 8
- Versions
- ≥ 0:11.0.18-2.Final_redhat_00001.1.el8eap: Not affected (rpm)
No fix published
red hat jboss enterprise application platform 7.4 for rhel 8
- Versions
- ≥ 0:1.1.2-1.redhat_00001.1.el8eap: Not affected (rpm)
No fix published
red hat jboss enterprise application platform 7.4 for rhel 8
- Versions
- ≥ 0:1.3.9-3.SP3_redhat_00001.1.el8eap: Not affected (rpm)
No fix published
red hat jboss enterprise application platform 7.4 for rhel 8
- Versions
- ≥ 0:2.0.1-3.Final_redhat_00001.1.el8eap: Not affected (rpm)
No fix published
red hat jboss enterprise application platform 7.4 for rhel 8
- Versions
- ≥ 0:5.0.27-4.SP2_redhat_00001.1.el8eap: Not affected (rpm)
No fix published
red hat jboss enterprise application platform 7.4 for rhel 8
- Versions
- ≥ 0:1.10.0-35.Final_redhat_00034.1.el8eap: Not affected (rpm)
No fix published
red hat jboss enterprise application platform 7.4 for rhel 8
- Versions
- ≥ 0:3.8.12-1.SP2_redhat_00001.1.el8eap: Not affected (rpm)
No fix published
red hat jboss enterprise application platform 7.4 for rhel 8
- Versions
- ≥ 0:1.0.17-1.Final_redhat_00001.1.el8eap: Not affected (rpm)
No fix published
red hat jboss enterprise application platform 7.4 for rhel 8
- Versions
- ≥ 0:5.5.5-6.redhat_2.1.el8eap: Not affected (rpm)
No fix published
red hat jboss enterprise application platform 7.4 for rhel 8
- Versions
- ≥ 0:2.2.30-1.SP1_redhat_00001.1.el8eap: Not affected (rpm)
No fix published
red hat jboss enterprise application platform 7.4 for rhel 8
- Versions
- ≥ 0:7.4.16-4.GA_redhat_00002.1.el8eap: Not affected (rpm)
No fix published
red hat jboss enterprise application platform 7.4 for rhel 8
- Versions
- ≥ 0:1.15.22-1.Final_redhat_00001.1.el8eap: Not affected (rpm)
No fix published
red hat jboss enterprise application platform 7.4 for rhel 9
- Versions
- ≥ 0:2.16.0-18.redhat_00052.1.el9eap: Not affected (rpm)
No fix published
red hat jboss enterprise application platform 7.4 for rhel 9
- Versions
- ≥ 0:3.4.10-2.redhat_00001.1.el9eap: Not affected (rpm)
No fix published
red hat jboss enterprise application platform 7.4 for rhel 9
- Versions
- ≥ 0:5.13.3.202401111512-1.r_redhat_00001.1.el9eap: Not affected (rpm)
No fix published
red hat jboss enterprise application platform 7.4 for rhel 9
- Versions
- ≥ 0:1.9.4-1.Final_redhat_00001.1.el9eap: Not affected (rpm)
No fix published
red hat jboss enterprise application platform 7.4 for rhel 9
- Versions
- ≥ 0:3.3.21-1.Final_redhat_00001.1.el9eap: Not affected (rpm)
No fix published
red hat jboss enterprise application platform 7.4 for rhel 9
- Versions
- ≥ 0:5.3.36-1.Final_redhat_00001.1.el9eap: Not affected (rpm)
No fix published
Original sources
- https://access.redhat.com/errata/RHSA-2024:1674
- https://access.redhat.com/errata/RHSA-2024:1675
- https://access.redhat.com/errata/RHSA-2024:1676
- https://access.redhat.com/errata/RHSA-2024:2763
- https://access.redhat.com/errata/RHSA-2024:2764
- https://access.redhat.com/security/cve/CVE-2024-1459
- https://bugzilla.redhat.com/show_bug.cgi?id=2259475
- https://access.redhat.com/errata/RHSA-2024:1677
- https://security.netapp.com/advisory/ntap-20241122-0008/
- https://nvd.nist.gov/vuln/detail/CVE-2024-1459