CVE-2024-1459: redhat undertow Path Traversal: '../filedir'
CVSS: 5.3v3.1MediumModified
AliasesUBUNTU-CVE-2024-1459DEBIAN-CVE-2024-1459GHSA-v76w-3ph8-vm66
Published 12-02-2024Last modified 04-08-2026
Vulnerability summary
CVE-2024-1459 is a medium (CVSS 5.3) Path Traversal: '../filedir' vulnerability in redhat undertow. EPSS estimates a 1.71% chance of exploitation in the next 30 days, higher than 77% of scored vulnerabilities.
CVSS score
5.3/10
010
Medium · v3.1 (CVE.org)EPSS score
1.71%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 4Timeline
- 12-02-2024PublishedVulnerability first disclosed.
- 04-08-2026Last modifiedVulnerability information updated.
Description
A path traversal vulnerability was found in Undertow. This issue may allow a remote attacker to append a specially-crafted sequence to an HTTP request for an application deployed to JBoss EAP, which may permit access to privileged or restricted files and directories.
CVSS metrics
5 scores · 5 sources · 1 versionMedium 5.3Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NSourcesAll 5 agree
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · MavenEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
1.71%
Chance of exploitation in the next 30 days
Percentile
77%
Versus all other CVEs
30-day change
0.00 pp
From 1.71% on 19-09-2026
19-09-202619-10-2026
EPSS score1.71%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- undertow< 2.3.18-1
Io.undertow1 product
- undertow-core< 2.2.31.Final | ≥ 2.3.0.Alpha1, < 2.3.12.Final
Redhat1 product
- undertowna
Ubuntu1 product
- undertowAll versions (No fix recorded)
4 vendors · 4 products
