[ CVE-2020-10199 · Published 1 Apr 2020 ]
Sonatype Nexus Repository Remote Code Execution Vulnerability
Exploited · CISA KEV CVSS 8.8
EPSS 99%Fix available
[ Why it matters ]Priority signals
- Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2021-11-03
- EPSS: 99% chance of exploitation in the next 30 days (higher than 100% of CVEs)
[ Description ]Official description
Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).
CISA: Sonatype Nexus Repository contains an unspecified vulnerability that allows for remote code execution.
[ Fixes ]Fixes and patches
CISA required action (US federal deadline 3 May 2022): Apply updates per vendor instructions.
- Patch on packetstormsecurity.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
- Patch on support.sonatype.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
[ References ]References
- packetstormsecurity.com/files/157261/Nexus-Repository-Manager-3.21.1-01-Remote-Code-Exe…PatchThird Party AdvisoryVDB Entry
- packetstormsecurity.com/files/160835/Sonatype-Nexus-3.21.1-Remote-Code-Execution.htmlExploitThird Party AdvisoryVDB Entry
- cwe.mitre.org/data/definitions/917.htmlThird Party Advisory
- support.sonatype.com/hc/en-us/articles/360044882533PatchVendor Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource