# CVE-2024-4956

Path Traversal in Sonatype Nexus Repository 3 allows an unauthenticated attacker to read system files. Fixed in version 3.68.1.

- Page: https://www.vulneraibility.com/cve/CVE-2024-4956
- CVSS: 7.5
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 19.15% (percentile 97.4)
- Public exploit code: 1 on Exploit-DB · 17 GitHub proofs of concept · 1 Nuclei template (first 2024-05-23)
- CISA SSVC: exploitation none, automatable yes, technical impact partial (assessed 2024-05-16)
- Weakness: CWE-22
- Published: 2024-05-16

## Affected versions

- Sonatype Nexus Repository: affected >= 3.0.0 and <= 3.68.0

A version outside these ranges is not a statement that it is unaffected.

## References

- [advisory] https://support.sonatype.com/hc/en-us/articles/29416509323923

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.