CVE-2024-36117
Published: 19 June 2024
Summary
CVE-2024-36117 is a high-severity Path Traversal (CWE-22) vulnerability in Reposilite Reposilite. Its CVSS base score is 8.6 (High).
Operationally, ranked in the top 1.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Reposilite, an open source repository manager for Maven-based artifacts in the JVM ecosystem, contains an arbitrary file read vulnerability in version 3.5.10. The flaw is a path traversal issue (CWE-22) that occurs while serving expanded Javadoc files and carries a CVSS 3.1 score of 8.6.
An unauthenticated remote attacker can exploit the vulnerability over the network to read arbitrary files on the server with high confidentiality impact and limited integrity and availability effects. The issue was discovered by the GitHub Security Lab and reported as GHSL-2024-074.
The project has released version 3.5.12 to address the flaw, with the fix available in the corresponding Git commit and tagged release; no workarounds are known. The associated EPSS score currently stands at 0.7371 after reaching a peak of 0.7783.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-2674
Vulnerability details
Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. Reposilite v3.5.10 is affected by an Arbitrary File Read vulnerability via path traversal while serving expanded javadoc files. Reposilite has addressed this issue…
more
in version 3.5.12. There are no known workarounds for this vulnerability. This issue was discovered and reported by the GitHub Security lab and is also tracked as GHSL-2024-074.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.