CVE-2019-5475

🗓️ 03 Sep 2019 19:13:43Reported by hackeroneType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 197 Views🌐 WEB

The Nexus Yum Repository Plugin in v2 is vulnerable to Remote Code Execution

Reporter	Title	Published	Views	Family All 23
Gitee	Exploit for OS Command Injection in Sonatype Nexus_Repository_Manager	24 Jan 202110:47	–	gitee
Gitee	Exploit for OS Command Injection in Sonatype Nexus_Repository_Manager	16 Feb 202300:17	–	gitee
GithubExploit	Exploit for OS Command Injection in Sonatype Nexus_Repository_Manager	25 Sep 201916:22	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Sonatype Nexus_Repository_Manager	16 Dec 202014:03	–	githubexploit
FreeBSD	nexus2-oss -- Multiple vulerabilities	19 Sep 201900:00	–	freebsd
BDU FSTEC	The vulnerability of Sonatype Nexus Repository Manager lies in the lack of measures to clean input data, allowing a perpetrator to execute arbitrary code.	15 Feb 202300:00	–	bdu_fstec
CNVD	Sonatype Nexus Repository Manager Operating System Command Injection Vulnerability	12 Aug 201900:00	–	cnvd
Cvelist	CVE-2019-5475	3 Sep 201919:13	–	cvelist
EUVD	EUVD-2019-6555	7 Oct 202500:30	–	euvd
Tenable Nessus	FreeBSD : nexus2-oss -- Multiple vulerabilities (b2f9573a-008c-11ea-9801-10c37b4ac2ea)	8 Nov 201900:00	–	nessus

NVD

Vulners

Node

sonatype nexus_repository_managerRange2.0–2.14.9-01

[
  {
    "product": "Nexus Repository Manager",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "2.14.9-01"
      }
    ]
  }
]

Source	Link
hackerone	www.hackerone.com/reports/654888

Parameter	Position	Path	Description	CWE
properties[0].value	request body	nexus/service/siesta/capabilities/xxxxxxxxx	Remote code execution via createrepoPath payload in Yum configuration (CVE-2019-5475)	CWE-78

17 Jun 2026 02:37Current

7.7High risk

Vulners AI Score7.7

CVSS 38.8

CVSS 29

EPSS0.18396

CWE-78