CVE-2024-1459 Undertow: directory traversal vulnerability

What is CVE-2024-1459?

CVE-2024-1459 is a medium-severity path traversal vulnerability in Red Hat Data Grid 8, published on 12 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A path traversal vulnerability was found in Undertow. This issue may allow a remote attacker to append a specially-crafted sequence to an HTTP request for an application deployed to JBoss EAP, which may permit access to privileged or restricted files and directories.

Weakness: CWE-24

Which versions are affected by CVE-2024-1459?

4 open source packages ship an affected version, including io.undertow:undertow-core. It affects 1 product.

Products include Redhat Undertow.

How do I fix CVE-2024-1459?

Upgrade io.undertow:undertow-core to a fixed version for your release line: 2.2.31.Final or 2.3.12.Final.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2024-1459 being exploited?

There is no known exploitation of CVE-2024-1459 in the wild and no public exploit code.

Other vulnerabilities in Red Hat Data Grid 8

• CVE-2020-1745 Improper Authorization in Undertoe High 8.6
• CVE-2018-1114 Uncontrolled Resource Consumption in Undertow Medium 6.5
• CVE-2017-7559 Undertow vulnerable to Request Smuggling Medium 6.1
• CVE-2014-7816 Improper Limitation of a Pathname to a Restricted Directory in JBoss Undertow Medium 5.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2024-1459, GHSA-v76w-3ph8-vm66, UBUNTU-CVE-2024-1459.