CVE-2020-10199

🗓️ 01 Apr 2020 18:27:23Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 1353 Views🌐 WEB

Sonatype Nexus Repository before 3.21.2 allows JavaEL Injectio

Reporter	Title	Published	Views	Family All 30
zdt	Nexus Repository Manager 3.21.1-01 Remote Code Execution Exploit	16 Apr 202000:00	–	zdt
Gitee	Exploit for Expression Language Injection in Sonatype Nexus	27 May 202014:46	–	gitee
GithubExploit	Exploit for Expression Language Injection in Sonatype Nexus	7 Apr 202013:23	–	githubexploit
GithubExploit	Exploit for Expression Language Injection in Sonatype Nexus	16 Apr 202009:40	–	githubexploit
ATTACKERKB	CVE-2020-10199	1 Apr 202000:00	–	attackerkb
BDU FSTEC	The vulnerability of Sonatype Nexus Repository Manager, related to improper code generation management, allows a perpetrator to execute arbitrary code.	9 Dec 202100:00	–	bdu_fstec
Circl	CVE-2020-10199	16 Apr 202000:38	–	circl
CISA KEV Catalog	Sonatype Nexus Repository Remote Code Execution Vulnerability	3 Nov 202100:00	–	cisa_kev
CNVD	Sonatype Nexus Repository Manager Command Execution Vulnerability (CNVD-2020-28477)	2 Apr 202000:00	–	cnvd
Check Point Advisories	Sonatype Nexus Repository Manager Remote Code Execution (CVE-2020-10199)	24 May 202000:00	–	checkpoint_advisories

NVD

Node

Source	Link
support	www.support.sonatype.com/hc/en-us/articles/360044882533
packetstormsecurity	www.packetstormsecurity.com/files/157261/Nexus-Repository-Manager-3.21.1-01-Remote-Code-Execution.html
cwe	www.cwe.mitre.org/data/definitions/917.html
packetstormsecurity	www.packetstormsecurity.com/files/160835/Sonatype-Nexus-3.21.1-Remote-Code-Execution.html
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
username	request body	/service/rapture/session	Login endpoint exploited to authenticate and perform subsequent attack.	CWE-917
password	request body	/service/rapture/session	Login endpoint exploited to authenticate and perform subsequent attack.	CWE-917
name	request body	/service/rest/beta/repositories/go/group	API endpoint used to trigger Java EL injection via crafted group member payload leading to remote code execution.	CWE-917
online	request body	/service/rest/beta/repositories/go/group	API endpoint used to trigger Java EL injection via crafted group member payload leading to remote code execution.	CWE-917
storage	request body	/service/rest/beta/repositories/go/group	API endpoint used to trigger Java EL injection via crafted group member payload leading to remote code execution.	CWE-917
group	request body	/service/rest/beta/repositories/go/group	API endpoint used to trigger Java EL injection via crafted group member payload leading to remote code execution.	CWE-917

17 Jun 2026 02:47Current

8.6High risk

Vulners AI Score8.6

CVSS 3.18.8

CVSS 29

EPSS0.99064

SSVC