CVE-2024-4956 - Vulnerability Details

Path Traversal in Sonatype Nexus Repository 3 allows an unauthenticated attacker to read system files. Fixed in version 3.68.1.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Sonatype	Nexus Repository Manager

No data.

References

Link	Providers
https://support.sonatype.com/hc/en-us/articles/29416509323923

History

No history.

MITRE

Status: PUBLISHED

Assigner: Sonatype

Published: 2024-05-16T15:31:01.795Z

Updated: 2024-08-01T20:55:10.367Z

Reserved: 2024-05-15T17:17:46.044Z

Link: CVE-2024-4956

Vulnrichment

Updated: 2024-08-01T20:55:10.367Z

NVD

Status : Awaiting Analysis

Published: 2024-05-16T16:15:10.887

Modified: 2024-11-21T09:43:56.520

Link: CVE-2024-4956

Redhat

No data.

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-4956", "assignerOrgId": "103e4ec9-0a87-450b-af77-479448ddef11", "state": "PUBLISHED", "assignerShortName": "Sonatype", "dateReserved": "2024-05-15T17:17:46.044Z", "datePublished": "2024-05-16T15:31:01.795Z", "dateUpdated": "2024-08-01T20:55:10.367Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:sonatype:nexus_repository_manager:3.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.5.2:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.6.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.6.2:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.7.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.7.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.8.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.9.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.10.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.11.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.12.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.12.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.13.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.14.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.15.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.15.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.15.2:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.16.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.16.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.16.2:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.17.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.18.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.18.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.19.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.19.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.20.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.20.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.21.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.21.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.21.2:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.22.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.22.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.23.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.24.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.25.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.25.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.26.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.26.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.27.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.28.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.28.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.29.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.29.2:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.30.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.30.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.31.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.31.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.32.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.33.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.33.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.34.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.34.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.35.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.36.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.37.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.37.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.32.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.37.2:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.37.3:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.38.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.38.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.39.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.40.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.40.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.41.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.41.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.42.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.43.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.44.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.45.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.45.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.46.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.47.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.47.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.48.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.49.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.50.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.51.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.52.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.53.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.53.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.54.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.54.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.55.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.56.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.57.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.57.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.58.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.58.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.59.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.60.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.61.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.62.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.63.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.64.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.65.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.66.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.67.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.67.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.68.0:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "Nexus Repository", "vendor": "Sonatype", "versions": [{"lessThanOrEqual": "3.68.0", "status": "affected", "version": "3.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Erick Fernando Xavier de Oliveira (erickfernandox)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Path Traversal in Sonatype Nexus Repository 3 allows an unauthenticated attacker to read system files. Fixed in version 3.68.1."}], "value": "Path Traversal in Sonatype Nexus Repository 3 allows an unauthenticated attacker to read system files. Fixed in version 3.68.1."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "103e4ec9-0a87-450b-af77-479448ddef11", "shortName": "Sonatype", "dateUpdated": "2024-05-16T15:31:01.795Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://support.sonatype.com/hc/en-us/articles/29416509323923"}], "source": {"discovery": "EXTERNAL"}, "title": "Nexus Repository 3 - Path Traversal", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-4956", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-16T18:27:46.330240Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:53:05.938Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T20:55:10.367Z"}, "title": "CVE Program Container", "references": [{"tags": ["vendor-advisory", "x_transferred"], "url": "https://support.sonatype.com/hc/en-us/articles/29416509323923"}]}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-4956 (string)

assignerOrgId : 103e4ec9-0a87-450b-af77-479448ddef11 (string)

state : PUBLISHED (string)

assignerShortName : Sonatype (string)

dateReserved : 2024-05-15T17:17:46.044Z (string)

datePublished : 2024-05-16T15:31:01.795Z (string)

dateUpdated : 2024-08-01T20:55:10.367Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

cpes : [ »

0 : cpe:2.3:a:sonatype:nexus_repository_manager:3.0.0:*:*:*:*:*:*:* (string)

1 : cpe:2.3:a:sonatype:nexus_repository_manager:3.0.2:*:*:*:*:*:*:* (string)

2 : cpe:2.3:a:sonatype:nexus_repository_manager:3.0.1:*:*:*:*:*:*:* (string)

3 : cpe:2.3:a:sonatype:nexus_repository_manager:3.1.0:*:*:*:*:*:*:* (string)

4 : cpe:2.3:a:sonatype:nexus_repository_manager:3.2.0:*:*:*:*:*:*:* (string)

5 : cpe:2.3:a:sonatype:nexus_repository_manager:3.2.1:*:*:*:*:*:*:* (string)

6 : cpe:2.3:a:sonatype:nexus_repository_manager:3.3.0:*:*:*:*:*:*:* (string)

7 : cpe:2.3:a:sonatype:nexus_repository_manager:3.3.1:*:*:*:*:*:*:* (string)

8 : cpe:2.3:a:sonatype:nexus_repository_manager:3.3.2:*:*:*:*:*:*:* (string)

9 : cpe:2.3:a:sonatype:nexus_repository_manager:3.4.0:*:*:*:*:*:*:* (string)

10 : cpe:2.3:a:sonatype:nexus_repository_manager:3.5.0:*:*:*:*:*:*:* (string)

11 : cpe:2.3:a:sonatype:nexus_repository_manager:3.5.1:*:*:*:*:*:*:* (string)

12 : cpe:2.3:a:sonatype:nexus_repository_manager:3.5.2:*:*:*:*:*:*:* (string)

13 : cpe:2.3:a:sonatype:nexus_repository_manager:3.6.0:*:*:*:*:*:*:* (string)

14 : cpe:2.3:a:sonatype:nexus_repository_manager:3.6.1:*:*:*:*:*:*:* (string)

15 : cpe:2.3:a:sonatype:nexus_repository_manager:3.6.2:*:*:*:*:*:*:* (string)

16 : cpe:2.3:a:sonatype:nexus_repository_manager:3.7.0:*:*:*:*:*:*:* (string)

17 : cpe:2.3:a:sonatype:nexus_repository_manager:3.7.1:*:*:*:*:*:*:* (string)

18 : cpe:2.3:a:sonatype:nexus_repository_manager:3.8.0:*:*:*:*:*:*:* (string)

19 : cpe:2.3:a:sonatype:nexus_repository_manager:3.9.0:*:*:*:*:*:*:* (string)

20 : cpe:2.3:a:sonatype:nexus_repository_manager:3.10.0:*:*:*:*:*:*:* (string)

21 : cpe:2.3:a:sonatype:nexus_repository_manager:3.11.0:*:*:*:*:*:*:* (string)

22 : cpe:2.3:a:sonatype:nexus_repository_manager:3.12.0:*:*:*:*:*:*:* (string)

23 : cpe:2.3:a:sonatype:nexus_repository_manager:3.12.1:*:*:*:*:*:*:* (string)

24 : cpe:2.3:a:sonatype:nexus_repository_manager:3.13.0:*:*:*:*:*:*:* (string)

25 : cpe:2.3:a:sonatype:nexus_repository_manager:3.14.0:*:*:*:*:*:*:* (string)

26 : cpe:2.3:a:sonatype:nexus_repository_manager:3.15.0:*:*:*:*:*:*:* (string)

27 : cpe:2.3:a:sonatype:nexus_repository_manager:3.15.1:*:*:*:*:*:*:* (string)

28 : cpe:2.3:a:sonatype:nexus_repository_manager:3.15.2:*:*:*:*:*:*:* (string)

29 : cpe:2.3:a:sonatype:nexus_repository_manager:3.16.0:*:*:*:*:*:*:* (string)

30 : cpe:2.3:a:sonatype:nexus_repository_manager:3.16.1:*:*:*:*:*:*:* (string)

31 : cpe:2.3:a:sonatype:nexus_repository_manager:3.16.2:*:*:*:*:*:*:* (string)

32 : cpe:2.3:a:sonatype:nexus_repository_manager:3.17.0:*:*:*:*:*:*:* (string)

33 : cpe:2.3:a:sonatype:nexus_repository_manager:3.18.0:*:*:*:*:*:*:* (string)

34 : cpe:2.3:a:sonatype:nexus_repository_manager:3.18.1:*:*:*:*:*:*:* (string)

35 : cpe:2.3:a:sonatype:nexus_repository_manager:3.19.0:*:*:*:*:*:*:* (string)

36 : cpe:2.3:a:sonatype:nexus_repository_manager:3.19.1:*:*:*:*:*:*:* (string)

37 : cpe:2.3:a:sonatype:nexus_repository_manager:3.20.0:*:*:*:*:*:*:* (string)

38 : cpe:2.3:a:sonatype:nexus_repository_manager:3.20.1:*:*:*:*:*:*:* (string)

39 : cpe:2.3:a:sonatype:nexus_repository_manager:3.21.0:*:*:*:*:*:*:* (string)

40 : cpe:2.3:a:sonatype:nexus_repository_manager:3.21.1:*:*:*:*:*:*:* (string)

41 : cpe:2.3:a:sonatype:nexus_repository_manager:3.21.2:*:*:*:*:*:*:* (string)

42 : cpe:2.3:a:sonatype:nexus_repository_manager:3.22.0:*:*:*:*:*:*:* (string)

43 : cpe:2.3:a:sonatype:nexus_repository_manager:3.22.1:*:*:*:*:*:*:* (string)

44 : cpe:2.3:a:sonatype:nexus_repository_manager:3.23.0:*:*:*:*:*:*:* (string)

45 : cpe:2.3:a:sonatype:nexus_repository_manager:3.24.0:*:*:*:*:*:*:* (string)

46 : cpe:2.3:a:sonatype:nexus_repository_manager:3.25.0:*:*:*:*:*:*:* (string)

47 : cpe:2.3:a:sonatype:nexus_repository_manager:3.25.1:*:*:*:*:*:*:* (string)

48 : cpe:2.3:a:sonatype:nexus_repository_manager:3.26.0:*:*:*:*:*:*:* (string)

49 : cpe:2.3:a:sonatype:nexus_repository_manager:3.26.1:*:*:*:*:*:*:* (string)

50 : cpe:2.3:a:sonatype:nexus_repository_manager:3.27.0:*:*:*:*:*:*:* (string)

51 : cpe:2.3:a:sonatype:nexus_repository_manager:3.28.0:*:*:*:*:*:*:* (string)

52 : cpe:2.3:a:sonatype:nexus_repository_manager:3.28.1:*:*:*:*:*:*:* (string)

53 : cpe:2.3:a:sonatype:nexus_repository_manager:3.29.0:*:*:*:*:*:*:* (string)

54 : cpe:2.3:a:sonatype:nexus_repository_manager:3.29.2:*:*:*:*:*:*:* (string)

55 : cpe:2.3:a:sonatype:nexus_repository_manager:3.30.0:*:*:*:*:*:*:* (string)

56 : cpe:2.3:a:sonatype:nexus_repository_manager:3.30.1:*:*:*:*:*:*:* (string)

57 : cpe:2.3:a:sonatype:nexus_repository_manager:3.31.0:*:*:*:*:*:*:* (string)

58 : cpe:2.3:a:sonatype:nexus_repository_manager:3.31.1:*:*:*:*:*:*:* (string)

59 : cpe:2.3:a:sonatype:nexus_repository_manager:3.32.0:*:*:*:*:*:*:* (string)

60 : cpe:2.3:a:sonatype:nexus_repository_manager:3.33.0:*:*:*:*:*:*:* (string)

61 : cpe:2.3:a:sonatype:nexus_repository_manager:3.33.1:*:*:*:*:*:*:* (string)

62 : cpe:2.3:a:sonatype:nexus_repository_manager:3.34.0:*:*:*:*:*:*:* (string)

63 : cpe:2.3:a:sonatype:nexus_repository_manager:3.34.1:*:*:*:*:*:*:* (string)

64 : cpe:2.3:a:sonatype:nexus_repository_manager:3.35.0:*:*:*:*:*:*:* (string)

65 : cpe:2.3:a:sonatype:nexus_repository_manager:3.36.0:*:*:*:*:*:*:* (string)

66 : cpe:2.3:a:sonatype:nexus_repository_manager:3.37.0:*:*:*:*:*:*:* (string)

67 : cpe:2.3:a:sonatype:nexus_repository_manager:3.37.1:*:*:*:*:*:*:* (string)

68 : cpe:2.3:a:sonatype:nexus_repository_manager:3.32.1:*:*:*:*:*:*:* (string)

69 : cpe:2.3:a:sonatype:nexus_repository_manager:3.37.2:*:*:*:*:*:*:* (string)

70 : cpe:2.3:a:sonatype:nexus_repository_manager:3.37.3:*:*:*:*:*:*:* (string)

71 : cpe:2.3:a:sonatype:nexus_repository_manager:3.38.0:*:*:*:*:*:*:* (string)

72 : cpe:2.3:a:sonatype:nexus_repository_manager:3.38.1:*:*:*:*:*:*:* (string)

73 : cpe:2.3:a:sonatype:nexus_repository_manager:3.39.0:*:*:*:*:*:*:* (string)

74 : cpe:2.3:a:sonatype:nexus_repository_manager:3.40.0:*:*:*:*:*:*:* (string)

75 : cpe:2.3:a:sonatype:nexus_repository_manager:3.40.1:*:*:*:*:*:*:* (string)

76 : cpe:2.3:a:sonatype:nexus_repository_manager:3.41.0:*:*:*:*:*:*:* (string)

77 : cpe:2.3:a:sonatype:nexus_repository_manager:3.41.1:*:*:*:*:*:*:* (string)

78 : cpe:2.3:a:sonatype:nexus_repository_manager:3.42.0:*:*:*:*:*:*:* (string)

79 : cpe:2.3:a:sonatype:nexus_repository_manager:3.43.0:*:*:*:*:*:*:* (string)

80 : cpe:2.3:a:sonatype:nexus_repository_manager:3.44.0:*:*:*:*:*:*:* (string)

81 : cpe:2.3:a:sonatype:nexus_repository_manager:3.45.0:*:*:*:*:*:*:* (string)

82 : cpe:2.3:a:sonatype:nexus_repository_manager:3.45.1:*:*:*:*:*:*:* (string)

83 : cpe:2.3:a:sonatype:nexus_repository_manager:3.46.0:*:*:*:*:*:*:* (string)

84 : cpe:2.3:a:sonatype:nexus_repository_manager:3.47.0:*:*:*:*:*:*:* (string)

85 : cpe:2.3:a:sonatype:nexus_repository_manager:3.47.1:*:*:*:*:*:*:* (string)

86 : cpe:2.3:a:sonatype:nexus_repository_manager:3.48.0:*:*:*:*:*:*:* (string)

87 : cpe:2.3:a:sonatype:nexus_repository_manager:3.49.0:*:*:*:*:*:*:* (string)

88 : cpe:2.3:a:sonatype:nexus_repository_manager:3.50.0:*:*:*:*:*:*:* (string)

89 : cpe:2.3:a:sonatype:nexus_repository_manager:3.51.0:*:*:*:*:*:*:* (string)

90 : cpe:2.3:a:sonatype:nexus_repository_manager:3.52.0:*:*:*:*:*:*:* (string)

91 : cpe:2.3:a:sonatype:nexus_repository_manager:3.53.0:*:*:*:*:*:*:* (string)

92 : cpe:2.3:a:sonatype:nexus_repository_manager:3.53.1:*:*:*:*:*:*:* (string)

93 : cpe:2.3:a:sonatype:nexus_repository_manager:3.54.0:*:*:*:*:*:*:* (string)

94 : cpe:2.3:a:sonatype:nexus_repository_manager:3.54.1:*:*:*:*:*:*:* (string)

95 : cpe:2.3:a:sonatype:nexus_repository_manager:3.55.0:*:*:*:*:*:*:* (string)

96 : cpe:2.3:a:sonatype:nexus_repository_manager:3.56.0:*:*:*:*:*:*:* (string)

97 : cpe:2.3:a:sonatype:nexus_repository_manager:3.57.0:*:*:*:*:*:*:* (string)

98 : cpe:2.3:a:sonatype:nexus_repository_manager:3.57.1:*:*:*:*:*:*:* (string)

99 : cpe:2.3:a:sonatype:nexus_repository_manager:3.58.0:*:*:*:*:*:*:* (string)

100 : cpe:2.3:a:sonatype:nexus_repository_manager:3.58.1:*:*:*:*:*:*:* (string)

101 : cpe:2.3:a:sonatype:nexus_repository_manager:3.59.0:*:*:*:*:*:*:* (string)

102 : cpe:2.3:a:sonatype:nexus_repository_manager:3.60.0:*:*:*:*:*:*:* (string)

103 : cpe:2.3:a:sonatype:nexus_repository_manager:3.61.0:*:*:*:*:*:*:* (string)

104 : cpe:2.3:a:sonatype:nexus_repository_manager:3.62.0:*:*:*:*:*:*:* (string)

105 : cpe:2.3:a:sonatype:nexus_repository_manager:3.63.0:*:*:*:*:*:*:* (string)

106 : cpe:2.3:a:sonatype:nexus_repository_manager:3.64.0:*:*:*:*:*:*:* (string)

107 : cpe:2.3:a:sonatype:nexus_repository_manager:3.65.0:*:*:*:*:*:*:* (string)

108 : cpe:2.3:a:sonatype:nexus_repository_manager:3.66.0:*:*:*:*:*:*:* (string)

109 : cpe:2.3:a:sonatype:nexus_repository_manager:3.67.0:*:*:*:*:*:*:* (string)

110 : cpe:2.3:a:sonatype:nexus_repository_manager:3.67.1:*:*:*:*:*:*:* (string)

111 : cpe:2.3:a:sonatype:nexus_repository_manager:3.68.0:*:*:*:*:*:*:* (string)

]

defaultStatus : unaffected (string)

product : Nexus Repository (string)

vendor : Sonatype (string)

versions : [ »

0 : { »

lessThanOrEqual : 3.68.0 (string)

status : affected (string)

version : 3.0.0 (string)

versionType : semver (string)

}

]

}

]

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

value : Erick Fernando Xavier de Oliveira (erickfernandox) (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : Path Traversal in Sonatype Nexus Repository 3 allows an unauthenticated attacker to read system files. Fixed in version 3.68.1. (string)

}

]

value : Path Traversal in Sonatype Nexus Repository 3 allows an unauthenticated attacker to read system files. Fixed in version 3.68.1. (string)

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 7.5 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-22 (string)

description : CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : 103e4ec9-0a87-450b-af77-479448ddef11 (string)

shortName : Sonatype (string)

dateUpdated : 2024-05-16T15:31:01.795Z (string)

}

references : [ »

0 : { »

tags : [ »

0 : vendor-advisory (string)

]

url : https://support.sonatype.com/hc/en-us/articles/29416509323923 (string)

}

]

source : { »

discovery : EXTERNAL (string)

}

title : Nexus Repository 3 - Path Traversal (string)

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-4956 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : yes (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-05-16T18:27:46.330240Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-06-04T17:53:05.938Z (string)

}

1 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-01T20:55:10.367Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

tags : [ »

0 : vendor-advisory (string)

1 : x_transferred (string)

]

url : https://support.sonatype.com/hc/en-us/articles/29416509323923 (string)

}

]

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://support.sonatype.com/hc/en-us/articles/29416509323923", "tags": ["vendor-advisory", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T20:55:10.367Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-4956", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-16T18:27:46.330240Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-16T18:29:07.179Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "Nexus Repository 3 - Path Traversal", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Erick Fernando Xavier de Oliveira (erickfernandox)"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:sonatype:nexus_repository_manager:3.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.5.2:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.6.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.6.2:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.7.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.7.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.8.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.9.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.10.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.11.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.12.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.12.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.13.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.14.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.15.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.15.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.15.2:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.16.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.16.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.16.2:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.17.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.18.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.18.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.19.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.19.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.20.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.20.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.21.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.21.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.21.2:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.22.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.22.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.23.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.24.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.25.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.25.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.26.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.26.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.27.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.28.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.28.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.29.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.29.2:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.30.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.30.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.31.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.31.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.32.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.33.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.33.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.34.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.34.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.35.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.36.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.37.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.37.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.32.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.37.2:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.37.3:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.38.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.38.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.39.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.40.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.40.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.41.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.41.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.42.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.43.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.44.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.45.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.45.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.46.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.47.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.47.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.48.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.49.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.50.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.51.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.52.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.53.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.53.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.54.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.54.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.55.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.56.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.57.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.57.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.58.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.58.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.59.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.60.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.61.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.62.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.63.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.64.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.65.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.66.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.67.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.67.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.68.0:*:*:*:*:*:*:*"], "vendor": "Sonatype", "product": "Nexus Repository", "versions": [{"status": "affected", "version": "3.0.0", "versionType": "semver", "lessThanOrEqual": "3.68.0"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://support.sonatype.com/hc/en-us/articles/29416509323923", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Path Traversal in Sonatype Nexus Repository 3 allows an unauthenticated attacker to read system files. Fixed in version 3.68.1.", "supportingMedia": [{"type": "text/html", "value": "Path Traversal in Sonatype Nexus Repository 3 allows an unauthenticated attacker to read system files. Fixed in version 3.68.1.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "103e4ec9-0a87-450b-af77-479448ddef11", "shortName": "Sonatype", "dateUpdated": "2024-05-16T15:31:01.795Z"}}}, "cveMetadata": {"cveId": "CVE-2024-4956", "state": "PUBLISHED", "dateUpdated": "2024-08-01T20:55:10.367Z", "dateReserved": "2024-05-15T17:17:46.044Z", "assignerOrgId": "103e4ec9-0a87-450b-af77-479448ddef11", "datePublished": "2024-05-16T15:31:01.795Z", "assignerShortName": "Sonatype"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://support.sonatype.com/hc/en-us/articles/29416509323923 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_transferred (string)

]

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-01T20:55:10.367Z (string)

}

1 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-4956 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : yes (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-05-16T18:27:46.330240Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-05-16T18:29:07.179Z (string)