CVE-2024-1459: Undertow: directory traversal vulnerability
A path traversal vulnerability was found in Undertow. This issue may allow a remote attacker to append a specially-crafted sequence to an HTTP request for an application deployed to JBoss EAP, which may permit access to privileged or restricted files and directories.
Other sources
A potential directory traversal vulnerability in JBoss EAP was discovered. Initial tests determined that appending "/..;/" to a request will return the JBoss EAP welcome page from the / directory.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/io.undertow:undertow-coreto a version that resolves this vulnerability.Fixed in 2.3.12.Final - Upgrade
Upgrade
maven/io.undertow:undertow-coreto a version that resolves this vulnerability.Fixed in 2.2.31.Final
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1459?
CVE-2024-1459 is classified as a high severity path traversal vulnerability.
How do I fix CVE-2024-1459?
To fix CVE-2024-1459, upgrade Undertow to version 2.3.12.Final or 2.2.31.Final.
What systems are affected by CVE-2024-1459?
CVE-2024-1459 affects applications deployed on JBoss EAP that use Undertow versions below 2.3.12.Final or 2.2.31.Final.
What is a path traversal vulnerability in CVE-2024-1459?
A path traversal vulnerability allows an attacker to access restricted files and directories by manipulating file path requests.
Is CVE-2024-1459 remotely exploitable?
Yes, CVE-2024-1459 can be exploited remotely through specially-crafted HTTP requests.