CVE-2024-4956

Path Traversal in Sonatype Nexus Repository 3 allows an unauthenticated attacker to read system files. Fixed in version 3.68.1.

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

18.25% chance of exploitation in the next 30 days, 97th percentile

Nuclei

high · CWE-22

Published

2024-05-16

Updated

2024-08-01

Proof-of-concept exploits (18)

• An00bRektn/shirocrack2★ · 2024-10-04
• Buff3st-0v3rfl0w/CVE-2024-49560★ · 2025-08-24
• Cappricio-Securities/CVE-2024-49563★ · 2024-06-24
• GoatSecurity/CVE-2024-49563★ · 2024-05-29
• JolyIrsb/CVE-2024-49560★ · 2024-08-14
• Praison001/CVE-2024-4956-Sonatype-Nexus-Repository-Manager2★ · 2024-06-01
• UMASANKAR-MG/Path-Traversal-CVE-2024-49560★ · 2024-09-26
• Zenhro/zenrho-cves-research1★ · 2024-08-07
• Zenrho/zenrho-cves-research1★ · 2024-08-07
• banditzCyber0x/CVE-2024-49561★ · 2024-05-26
• erickfernandox/CVE-2024-49563★ · 2024-05-23
• fin3ss3g0d/CVE-2024-49569★ · 2024-11-14
• gmh5225/CVE-2024-49562★ · 2024-05-23
• thinhap/CVE-2024-4956-PoC1★ · 2024-05-27
• verylazytech/CVE-2024-495616★ · 2024-11-26
• xungzzz/CVE-2024-49563★ · 2024-05-23
• GraySignal/CVE-2024-4956-Sonatype-Nexus-Repository-Manager
• art-of-defence/CVE-2024-4956

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4956.yaml

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/52101

Vulhub environments (1)

• vulhub/vulhub/tree/master/nexus/CVE-2024-4956

Exploit collections (1)

• zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2024/CVE-2024-4956.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2021-4034
• CVE-2000-0114
• CVE-2009-0347
• CVE-2012-5321
• CVE-2015-1635
• CVE-2015-7297