Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWcyZjYtdjVxaC1oMm1x

Nexus Repository Manager 3 - Remote Code Execution

Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).

Permalink: https://github.com/advisories/GHSA-g2f6-v5qh-h2mq
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWcyZjYtdjVxaC1oMm1x
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 5 years ago
Updated: almost 2 years ago

CVSS Score: 8.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Percentage: 0.97339
EPSS Percentile: 0.99953

Identifiers: GHSA-g2f6-v5qh-h2mq, CVE-2020-10199
References:

• https://nvd.nist.gov/vuln/detail/CVE-2020-10199
• https://securitylab.github.com/advisories/GHSL-2020-015-nxrm-sonatype
• https://support.sonatype.com/hc/en-us/articles/360044882533
• http://packetstormsecurity.com/files/157261/Nexus-Repository-Manager-3.21.1-01-Remote-Code-Execution.html
• http://packetstormsecurity.com/files/160835/Sonatype-Nexus-3.21.1-Remote-Code-Execution.html
• https://cwe.mitre.org/data/definitions/917.html
• https://github.com/advisories/GHSA-g2f6-v5qh-h2mq

Blast Radius: 9.5

Affected Packages