What is the CVSS score of CVE-2024-1142?

CVE-2024-1142 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.7%.

Sonatype IQ Server CVE-2024-1142

MEDIUM

Path Traversal (CWE-22)

2024-03-21 103e4ec9-0a87-450b-af77-479448ddef11

Path Traversal

5.4

CVSS 3.1 · Vendor: 103e4ec9-0a87-450b-af77-479448ddef11

Severity by source

Vendor (103e4ec9-0a87-450b-af77-479448ddef11) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Primary rating from Vendor (103e4ec9-0a87-450b-af77-479448ddef11) · only source for this CVE.

CVSS VectorVendor: 103e4ec9-0a87-450b-af77-479448ddef11

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

CVE Published

Mar 21, 2024 - 02:51 cve.org

MEDIUM 5.4

DescriptionCVE.org

Path Traversal in Sonatype IQ Server from version 143 allows remote authenticated attackers to overwrite or delete files via a specially crafted request. Version 171 fixes this issue.

AnalysisAI

Path Traversal in Sonatype IQ Server from version 143 allows remote authenticated attackers to overwrite or delete files via a specially crafted request. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Path Traversal (CWE-22), which allows attackers to access files and directories outside the intended path. Path Traversal in Sonatype IQ Server from version 143 allows remote authenticated attackers to overwrite or delete files via a specially crafted request. Version 171 fixes this issue. Version information: version 143.

Affected ProductsAI

Sonatype IQ Server from version 143.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate and canonicalize file paths. Use chroot or sandboxing. Reject input containing path separators or '../' sequences.