Description

Sonatype Nexus Repository Manager 3 is vulnerable to a path traversal issue that allows unauthenticated attackers to read arbitrary files.

Remediation

Upgrade to Nexus Repository Manager version 3.68.1 or later

References

Sonatype Support Article

Related Vulnerabilities

Magento Insufficient Session Expiration Vulnerability (CVE-2019-8149)

IBM RTC Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2014-6131)

Magento Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-7939)

Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2014-7837)

Apache Tomcat Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2009-2696)

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Directory Traversal Known Vulnerabilities CWE-22 CVE-2024-4956