Lucene search

SonatypeCVELIST:CVE-2024-1142

HistoryMar 06, 2024 - 8:08 p.m.

CVE-2024-1142 Sonatype IQ Server - Path Traversal

2024-03-0620:08:21

CWE-22

Sonatype

www.cve.org

path traversal

sonatype iq server

remote attackers

overwrite files

delete files

version 171

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

5.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

10.5%

JSON

Path Traversal in Sonatype IQ Server from version 143 allows remote authenticated attackers to overwrite or delete files via a specially crafted request. Version 171 fixes this issue.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "IQ Server",
    "vendor": "Sonatype",
    "versions": [
      {
        "lessThan": "171",
        "status": "affected",
        "version": "143",
        "versionType": "custom"
      }
    ]
  }
]

References

support.sonatype.com/hc/en-us/articles/27034479038739-CVE-2024-1142-Sonatype-IQ-Server-Path-Traversal-2024-03-06

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

5.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

10.5%

JSON

Related for CVELIST:CVE-2024-1142