Path Traversal in Dzikoysk Reposilite
CVE-2024-36117
Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. Reposilite v3.5.10 is affected by an Arbitrary File Read vulnerability via path traversal while serving expanded javadoc files. Reposilite has addressed this issue in version 3.5.12. There are no known workarounds for this vulnerability. This issue was discovered and reported by the GitHub Security lab and is also tracked as GHSL-2024-074.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.031 (86.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L.
Affected products
- Dzikoysk Reposilite — versions >= 3.3.0, < 3.5.12
- Reposilite
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Release Notes)
- security-advisories@github.com (Exploit, x_refsource_MISC, Mitigation, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
Frequently asked questions
- What is CVE-2024-36117?
- CVE-2024-36117 is a high-severity vulnerability in Dzikoysk Reposilite, classified under Path Traversal. CVSS score: 8.6/10. Published 2024-06-19.
- How severe is CVE-2024-36117?
- High severity. CVSS v3 base score is 8.6 out of 10.
- Is CVE-2024-36117 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.