CVE-2021-34553: Path Traversal
First published: Fri Jun 18 2021(Updated: )
Sonatype Nexus Repository Manager 3.x before 3.31.0 allows a remote authenticated attacker to get a list of blob files and read the content of a blob file (via a GET request) without having been granted access.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Sonatype Nexus Repository Manager | >=3.0.0<3.31.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2021-34553.
What is the affected software?
The affected software is Sonatype Nexus Repository Manager 3.x before version 3.31.0.
What is the severity of CVE-2021-34553?
The severity of CVE-2021-34553 is medium (4.3).
How does CVE-2021-34553 work?
CVE-2021-34553 allows a remote authenticated attacker to get a list of blob files and read the content of a blob file without having been granted access.
How can I fix CVE-2021-34553?
To fix CVE-2021-34553, upgrade to Sonatype Nexus Repository Manager version 3.31.0 or later.
- collector/nvd-index
- vendor/sonatype
- canonical/sonatype nexus repository manager
- version/sonatype nexus repository manager/3.0.0