CVE-2024-1459

MEDIUM 5.3

Undertow: directory traversal vulnerability

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

A path traversal vulnerability was found in Undertow. This issue may allow a remote attacker to append a specially-crafted sequence to an HTTP request for an application deployed to JBoss EAP, which may permit access to privileged or restricted files and directories.

CWE	CWE-24
Published	Feb 12, 2024
Last Updated	Nov 11, 2025

Stay Ahead of the Next One

Get instant alerts for

Be the first to know when new medium vulnerabilities are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 8

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

All versions affected

Red Hat / Red Hat build of Quarkus

All versions affected

Red Hat / Red Hat Data Grid 8

All versions affected

Red Hat / Red Hat Decision Manager 7

All versions affected

Red Hat / Red Hat Fuse 7

All versions affected

Red Hat / Red Hat JBoss Data Grid 7

All versions affected

Red Hat / Red Hat JBoss Fuse 6

All versions affected

Red Hat / Red Hat Process Automation 7

All versions affected

Red Hat / Red Hat Single Sign-On 7

All versions affected

References

NVD ↗ CVE.org ↗ EPSS Data ↗

access.redhat.com: https://access.redhat.com/errata/RHSA-2024:1674 access.redhat.com: https://access.redhat.com/errata/RHSA-2024:1675 access.redhat.com: https://access.redhat.com/errata/RHSA-2024:1676 access.redhat.com: https://access.redhat.com/errata/RHSA-2024:2763 access.redhat.com: https://access.redhat.com/errata/RHSA-2024:2764 access.redhat.com: https://access.redhat.com/security/cve/CVE-2024-1459 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2259475 access.redhat.com: https://access.redhat.com/errata/RHSA-2024:1677 security.netapp.com: https://security.netapp.com/advisory/ntap-20241122-0008/

Credits

Red Hat would like to thank AAIB IT Unix Team for reporting this issue.