Nexus Repository Manager - Java EL Injection RCE (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Nexus Repository Manager Java EL Injection RCE', 'Description' = %q This module exploits a Java Expression Language EL injection in Nexus...

Nexus Repository Manager 3.21.1-01 Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Nexus Repository Manager Java EL Injection RCE', 'Description' = %q This module exploits a Java Expression Language EL injection in Nexus...

Nexus Repository Manager 3.21.1-01 Remote Code Execution Exploit

This Metasploit module exploits a Java Expression Language EL injection in Nexus Repository Manager versions up to and including 3.21.1 to execute code as the Nexus user. Tested against 3.21.1-01. This module requires Metasploit: https://metasploit.com/download Current source:...

Persistent Cross-Site scripting in Nexus Repository Manager

Sonatype Nexus Repository before 3.21.2 allows XSS...

GHSA-3944-787C-F852 Persistent Cross-Site scripting in Nexus Repository Manager

Sonatype Nexus Repository before 3.21.2 allows XSS...

Remote Code Execution - JavaEL Injection (low privileged accounts) in Nexus Repository Manager

Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution...

Nexus Repository Manager Incorrect Access Control Vulnerability

Nexus Repository Manager is a repository manager from Sonatype that lets you proxy, collect, and manage your dependencies so you don't have to deal with a series of JARs on a regular basis, making it easy to distribute your software. An incorrect access control vulnerability exists in Nexus...

Improper access control

Sonatype Nexus Repository Manager 3.x up to and including 3.21.2 has Incorrect Access Control...

CVE-2020-11444

Sonatype Nexus Repository Manager 3.x up to and including 3.21.2 has Incorrect Access Control...

CVE-2020-11444

CVE-2020-11444 affects Sonatype Nexus Repository Manager 3.x up to 3.21.2, with an Incorrect Access Control flaw that enables unauthorized actions on the server. Red Hat and CNVD entries confirm the issue exists in Nexus 3.x; public exploit references show a workaround: an unauthenticated or mini...

Sonatype Nexus Repository Manager Command Execution Vulnerability

Sonatype Nexus Repository Manager NXRM is a Maven repository manager from Sonatype USA. A command execution vulnerability exists in Sonatype Nexus Repository Manager. An attacker can exploit this vulnerability to execute code...

Sonatype Nexus Repository Manager Command Execution Vulnerability (CNVD-2020-28477)

Sonatype Nexus Repository Manager NXRM is a Maven repository manager from Sonatype USA. A command execution vulnerability exists in Sonatype Nexus Repository Manager. An attacker can exploit this vulnerability to execute arbitrary code with the help of a malicious request...

Sonatype Nexus Repository Manager 3 Remote Code Execution (CVE-2019-7238)

A remote code execution vulnerability exists in Sonatype Nexus Repository Manager 3. This vulnerability is due to insufficient validation of the parameter in the previewAssets function. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the...

Command Execution Vulnerability in Nexus Repository Manager

Sonatype Nexus is a Maven repository management system that provides powerful repository management, component search, and can be used to build a Maven repository self-service to save bandwidth and time by maintaining a local repository while proxying a remote repository. A command execution...

CVE-2019-15588

There is an OS Command Injection in Nexus Repository Manager = 2.14.14 bypass CVE-2019-5475 that could allow an attacker a Remote Code Execution RCE. All instances using CommandLineExecutor.java with user-supplied data is vulnerable, such as the Yum Configuration Capability...

CVE-2019-15588

There is an OS Command Injection in Nexus Repository Manager = 2.14.14 bypass CVE-2019-5475 that could allow an attacker a Remote Code Execution RCE. All instances using CommandLineExecutor.java with user-supplied data is vulnerable, such as the Yum Configuration Capability...

Command injection

There is an OS Command Injection in Nexus Repository Manager = 2.14.14 bypass CVE-2019-5475 that could allow an attacker a Remote Code Execution RCE. All instances using CommandLineExecutor.java with user-supplied data is vulnerable, such as the Yum Configuration Capability...

CVE-2019-15588

Summary (CVE-2019-15588) : Nexus Repository Manager versions up to 2.14.14 are affected by an OS command injection that can lead to remote code execution. The root cause involves untrusted data flowing into CommandLineExecutor.java, notably via the Yum Configuration Capability (createrepo/mergere...

CVE-2019-15588

There is an OS Command Injection in Nexus Repository Manager = 2.14.14 bypass CVE-2019-5475 that could allow an attacker a Remote Code Execution RCE. All instances using CommandLineExecutor.java with user-supplied data is vulnerable, such as the Yum Configuration Capability...

Central Security Project: OS Command Injection in Nexus Repository Manager 2.x -- Bypass for Nexus Repository Manage 2.14.15-01 Command Injection fix

https://support.sonatype.com/hc/en-us/articles/360033490774 An OS command injection vulnerability has been discovered in Nexus Repository Manager requiring immediate action. The vulnerability allows for an attacker with administrative access to nxrm to execute arbitrary commands on the system. We...