Detections
Analytics
SCA: security update for com.reposilite:reposilite-backend (GHSA-9w8w-34vr-65j2)
high Tenable Cloud Security Plugin ID 413505
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in
JVM ecosystem. As a Maven repository manager, Reposilite provides the ability to view the artifacts
content in the browser, as well as perform administrative tasks via API. The problem lies in the fact that
the artifact's content is served via the same origin (protocol/host/port) as the Admin UI. If the artifact
contains HTML content with javascript inside, the javascript is executed within the same origin.
Therefore, if an authenticated user is viewing the artifacts content, the javascript inside can access the
browser's local storage where the user's password (aka 'token-secret') is stored. It is especially
dangerous in scenarios where Reposilite is configured to mirror third party repositories, like the Maven
Central Repository. Since anyone can publish an artifact to Maven Central under its own name, such
malicious packages can be used to attack the Reposilite instance. This issue may lead to the full
Reposilite instance compromise. If this attack is performed against the admin user, it's possible to use
the admin API to modify settings and artifacts on the instance. In the worst case scenario, an attacker
would be able to obtain the Remote code execution on all systems that use artifacts from Reposilite. It's
important to note that the attacker does not need to lure a victim user to use a malicious artifact, but
just open a link in the browser. This link can be silently loaded among the other HTML content, making
this attack unnoticeable. Even if the Reposilite instance is located in an isolated environment, such as
behind a VPN or in the local network, this attack is still possible as it can be performed from the admin
browser. Reposilite has addressed this issue in version 3.5.12. Users are advised to upgrade. There are no
known workarounds for this vulnerability. This issue was discovered and reported by the GitHub Security
lab and is also tracked as GHSL-2024-072. (CVE-2024-36115)
See Also
Plugin Details
Severity: High
ID: 413505
Version: Revision 1.22
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 57.49
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: High
Base Score: 7.6
Temporal Score: 5.6
Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2024-36115
CVSS v3
Risk Factor: High
Base Score: 7.1
Temporal Score: 6.2
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: High
Base Score: 7.7
Threat Score: 5.2
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 8/2/2024
Vulnerability Publication Date: 6/19/2024
Reference Information
CVE: CVE-2024-36115
cwe: CWE-79