Sonatype: Security Vulnerabilities
An issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.17 and 3.x before 3.22.1. Admin users can retrieve the LDAP server system username/password (as configured in nxrm) in cleartext.
CVSS Score
4.9
EPSS Score
0.006
Published
2020-04-27
An issue was discovered in Sonatype Nexus Repository Manager in versions 3.21.1 and 3.22.0. It is possible for a user with appropriate privileges to create, modify, and execute scripting tasks without use of the UI or API. NOTE: in 3.22.0, scripting is disabled by default (making this not exploitable).
CVSS Score
8.8
EPSS Score
0.017
Published
2020-04-20
Sonatype Nexus Repository Manager 3.x up to and including 3.21.2 has Incorrect Access Control.
CVSS Score
8.8
EPSS Score
0.085
Published
2020-04-02
CVE-2020-10199
Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).
Known exploited
CVSS Score
8.8
EPSS Score
0.991
Published
2020-04-01
Sonatype Nexus Repository before 3.21.2 allows XSS.
CVSS Score
4.8
EPSS Score
0.009
Published
2020-04-01
Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution.
CVSS Score
7.2
EPSS Score
0.252
Published
2020-04-01
There is an OS Command Injection in Nexus Repository Manager <= 2.14.14 (bypass CVE-2019-5475) that could allow an attacker a Remote Code Execution (RCE). All instances using CommandLineExecutor.java with user-supplied data is vulnerable, such as the Yum Configuration Capability.
CVSS Score
7.2
EPSS Score
0.056
Published
2019-11-01
Sonatype Nexus Repository Manager 2.x before 2.14.15 and 3.x before 3.19, and IQ Server before 72, has remote code execution.
CVSS Score
7.2
EPSS Score
0.033
Published
2019-10-21
Sonatype Nexus Repository Manager 2.x before 2.14.15 allows Remote Code Execution.
CVSS Score
7.2
EPSS Score
0.021
Published
2019-10-16
The Nexus Yum Repository Plugin in v2 is vulnerable to Remote Code Execution when instances using CommandLineExecutor.java are supplied vulnerable data, such as the Yum Configuration Capability.
CVSS Score
8.8
EPSS Score
0.184
Published
2019-09-03