CVE-2024-4956
Nexus Repository 3 - Path Traversal
HIGH
7.5
CVSS Score
Published: May 16, 2024 at 03:31 PM UTC
Updated: June 17, 2026 at 08:03 AM UTC
2 products affected across 1 vendorNexus Repository ManagerNexus
Using Nexus Repository by Sonatype?
Get instant alerts when new vulnerabilities affect Nexus Repository - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
HIGH7.5
Exploit prediction
EPSS 19%
SSVC
No known exploit
Description
Path Traversal in Sonatype Nexus Repository 3 allows an unauthenticated attacker to read system files. Fixed in version 3.68.1.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
3.0.03.0.13.0.23.1.03.10.03.11.03.12.03.12.13.13.03.14.03.15.03.15.13.15.23.16.03.16.13.16.23.17.03.18.03.18.13.19.03.19.13.2.03.2.13.20.03.20.13.21.03.21.13.21.23.22.03.22.13.23.03.24.03.25.03.25.13.26.03.26.13.27.03.28.03.28.13.29.03.29.23.3.03.3.13.3.23.30.03.30.13.31.03.31.13.32.03.32.13.33.03.33.13.34.03.34.13.35.03.36.03.37.03.37.13.37.23.37.33.38.03.38.13.39.03.4.03.40.03.40.13.41.03.41.13.42.03.43.03.44.03.45.03.45.13.46.03.47.03.47.13.48.03.49.03.5.03.5.13.5.23.50.03.51.03.52.03.53.03.53.13.54.03.54.13.55.03.56.03.57.03.57.13.58.03.58.13.59.03.6.03.6.13.6.23.60.03.61.03.62.03.63.03.64.03.65.03.66.03.67.03.67.13.68.03.7.03.7.13.8.03.9.0
3.0.0 ≤ v ≤ 3.68.03.0.0
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
References (1)
Vendor Advisory
Source: 103e4ec9-0a87-450b-af77-479448ddef11
https://support.sonatype.com/hc/en-us/articles/29416509323923SSVC — Action Prioritization
SSVCNo known exploitAutomatablePartial impact
SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.
CVSS
7.5HIGHSonatype
- Attack Vector
- NETWORK
- Complexity
- LOW
- Privileges
- NONE
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality
- HIGH
- Integrity
- NONE
- Availability
- NONE
Vector?
Quick Info
StatusDEFERRED
CWE
CWE-22
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card