9 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:S/C:C/I:C/A:C
7.2 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
0.008 Low
EPSS
Percentile
81.1%
Sonatype reports:
Several RCE vulnerabilities have been found and corrected in 2.14.15:
CVE-2019-16530: An attacker with elevated privileges can upload a
specially crafted file. That file can contain commands that will
be executed on the system, with the same privileges as the user
running the server.
CVE-2019-15893: A Remote Code Execution vulnerability has been
discovered in Nexus Repository Manager requiring immediate
action. The vulnerability allows for an attacker with
administrative access to NXRM to create repostories that can
grant access to read/execute system data outside the scope of
NXRM.
CVE-2019-5475: A vulnerability has been found that can allow
user’s with administrative privileges to run processes on the
target server, that the nxrm os user has access to.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
FreeBSD | any | noarch | nexus2-oss | < 2.14.15 | UNKNOWN |
9 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:S/C:C/I:C/A:C
7.2 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
0.008 Low
EPSS
Percentile
81.1%