CVE-2014-7816
NoneCVSS
—
EPSS
25.1%
Published
Dec 1, 2014
CISA due date
—
The record
Directory traversal vulnerability in JBoss Undertow 1.0.x before 1.0.17, 1.1.x before 1.1.0.CR5, and 1.2.x before 1.2.0.Beta3, when running on Windows, allows remote attackers to read arbitrary files via a .. (dot dot) in a resource URI.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | io.undertow:undertow-core | 1.0.0 | 1.0.17 |
| Maven | io.undertow:undertow-core | 1.1.0.Beta1 | 1.1.0.CR5 |
| Maven | io.undertow:undertow-core | 1.2.0.Beta1 | 1.2.0.Beta3 |
| maven | io.undertow/undertow-core | 1.0-alpha0 | No fix |
| maven | io.undertow/undertow-core | 1.1-alpha0 | No fix |
| maven | io.undertow/undertow-core | 1.2-alpha0 | No fix |
Related vulnerabilities
- GHSA-33hj-rcmx-86mv Undertow Servlets Vulnerable to Remote DoS via OutOfMemoryError when Passed Large… Also affects io.undertow:undertow-core
- CVE-2024-4027 A flaw was found in Undertow. Also affects io.undertow:undertow-core
- CVE-2025-12543 A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP… Also affects io.undertow:undertow-core
- CVE-2024-3884 A flaw was found in Undertow that can cause remote denial of service attacks. Also affects io.undertow:undertow-core
- CVE-2024-4109 undertow: information leakage via HTTP/2 request header reuse Also affects io.undertow:undertow-core
- CVE-2023-4639 A flaw was found in Undertow, which incorrectly parses cookies with certain… Also affects io.undertow:undertow-core
- CVE-2023-1973 A flaw was found in Undertow package. Also affects io.undertow:undertow-core
- CVE-2024-7885 A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same… Also affects io.undertow:undertow-core