CVE-2024-4956

Deeper analysis

Path Traversal vulnerability CVE-2024-4956 affects Sonatype Nexus Repository 3 and is tracked under CWE-22. It carries a CVSS 3.1 base score of 7.5 with an attack vector of network, low complexity, no privileges, and no user interaction, resulting in high confidentiality impact while leaving integrity and availability unaffected. The flaw permits an unauthenticated attacker to read arbitrary system files.

An unauthenticated remote attacker can send crafted requests to the affected repository instance and retrieve sensitive files stored on the underlying system. Successful exploitation yields direct access to configuration data or other protected content without requiring credentials or user assistance.

Sonatype has published mitigation guidance stating that the issue is resolved in Nexus Repository version 3.68.1; administrators are advised to upgrade promptly using the instructions in the vendor advisory at https://support.sonatype.com/hc/en-us/articles/29416509323923.

The associated EPSS score stands at 0.9403 with an identical recorded peak, indicating sustained high exploitation probability since disclosure.