Medium WID-SEC-2024-1174 1 CVE

Sonatype Nexus Repository Manager: Schwachstelle ermöglicht Offenlegung von Informationen

Published May 16, 2024 · Updated May 16, 2024 · de-DE

Vendor: Sonatype Product: Nexus Repository Manager Platform: Linux Platform: macOS Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Sonatype Nexus Repository Manager ausnutzen, um Informationen offenzulegen.

Product

Sonatype Nexus Repository Manager ist ein Verwaltungstool für Software-Bestandteile.

Vulnerabilities 1

High 7.5

CVE-2024-4956 Public exploit Scanner template EPSS 19%

Nexus Repository 3 - Path Traversal

Path Traversal in Sonatype Nexus Repository 3 allows an unauthenticated attacker to read system files. Fixed in version 3.68.1.

Sonatype Nexus Repository

May 16, 2024

Revision history

2024-05-16 #1
Initiale Fassung

References

Sonatype Nexus Security Advisory vom 2024-05-16
https://support.sonatype.com/hc/en-us/articles/29416509323923-CVE-2024-4956-Nexus-Repository-3-Vulnerability
Mitigations for CVE-2024-4956 Nexus Repository 3 Vulnerability vom 2024-05-16
https://support.sonatype.com/hc/en-us/articles/29412417068819-Mitigations-for-CVE-2024-4956-Nexus-Repository-3-Vulnerability
GitHub Database
https://github.com/advisories/GHSA-6cgv-69mq-8w7x