PT-2024-16978 · Sonatype · Sonatype Iq Server

Published 2024-03-06 · Updated 2024-03-21 · CVE-2024-1142

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Sonatype IQ Server versions 143 through 170

Description The issue allows remote authenticated attackers to overwrite or delete files via a specially crafted request.

Recommendations For Sonatype IQ Server versions 143 through 170, update to version 171 to resolve the issue.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-1142

Affected Products

Sonatype Iq Server

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2024-1142 · Security Note
• https://support.sonatype.com/hc/en-us/articles/27034479038739-CVE-2024-1142-Sonatype-IQ-Server-Path-Traversal-2024-03-06 · Vendor Advisory