Potential Path Traversal Vulnerability in Undertow Could Allow Access to Privileged Files
CVE-2024-1459
5.3MEDIUM
Key Information:
What is CVE-2024-1459?
A path traversal vulnerability was found in Undertow. This issue may allow a remote attacker to append a specially-crafted sequence to an HTTP request for an application deployed to JBoss EAP, which may permit access to privileged or restricted files and directories.
Affected Version(s)
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 0:2.16.0-18.redhat_00052.1.el8eap
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 0:3.4.10-2.redhat_00001.1.el8eap
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 0:5.13.3.202401111512-1.r_redhat_00001.1.el8eap
References
EPSS Score
5% chance of being exploited in the next 30 days.
CVSS V3.1
Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Red Hat would like to thank AAIB IT Unix Team for reporting this issue.