Sonatype Nexus Repository security vulnerabilities

Nexus Repository Manager is a repository management system. A path traversal vulnerability exists in Sonatype Nexus Repository Manager that can be exploited by an attacker to obtain sensitive information...

PT-2024-4555

Name of the Vulnerable Software and Affected Versions Sonatype Nexus Repository versions prior to 3.68.1 Description A path traversal issue exists in Sonatype Nexus Repository 3 due to improper restriction of directory path names. This allows an unauthenticated remote attacker to read sensitive...

CVE-2024-4956: Improper Limitation of a Pathname to a Restricted Directory

Path Traversal in Sonatype Nexus Repository 3 allows an unauthenticated attacker to read system files. Fixed in version 3.68.1...

Exploit for OS Command Injection in Sonatype Nexus_Repository_Manager

CVE-2019-5475 CVE-2019-5475 与 CVE-2019-15588 靶场: RCE 命令注入漏洞 ------ 0x00 背景 CVE-2019-5475 是 Nexus 关于内置插件 Yum Repository 的 RCE 命令注入漏洞，其最早被披露于 hackerone，但因官方第一次修复不完整，故又衍生出了 CVE-2019-15588 漏洞。 这两个漏洞都需要以 admin 身份登录后才可以利用，但是 nexus 默认管理员密码 admin123 经常被忽略修改，很容易就被利用了。 0x10 靶场环境 0x20 目录结构 CVE-2019-5475 ├──...

SUSE CVE-2019-9630

Sonatype Nexus Repository Manager before 3.17.0 has a weak default of giving any unauthenticated user read permissions on the repository files and images...

SUSE CVE-2019-9629

Sonatype Nexus Repository Manager before 3.17.0 establishes a default administrator user with weak defaults fixed credentials...

Sonatype Nexus Repository Manager Code Execution

The vulnerability of Sonatype Nexus Repository Manager is related to the lack of measures for cleaning input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Sonatype Nexus Repository Manager Privilege Escalation

The vulnerability of Sonatype Nexus Repository Manager is related to insecure management of privileges. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...

PT-2022-20666

Name of the Vulnerable Software and Affected Versions Sonatype Nexus Repository Manager OSS version 3.37.3-02 Description The issue is related to incorrect access control, allowing for authentication bypass. This can be exploited remotely, with the attack vector involving response manipulation. A...

Unrestricted Upload of File with Dangerous Type in Sonatype Nexus Repository Manager

Sonatype Nexus Repository Manager 2.x before 2.14.15 and 3.x before 3.19, and IQ Server before 72, has remote code execution...

org.sonatype.nexus.assemblies:nexus-base-template (>=3.4.0-02, <=3.18.1-01), org.sonatype.nexus.assemblies:nexus-core-feature (>=3.0.0-03, <=3.18.1-01) +22 more potentially affected by CVE-2019-16530 via org.sonatype.nexus:nexus-repository (>=3.0.0-03, <=3.18.1-01)

org.sonatype.nexus:nexus-repository MAVEN version =3.0.0-03, =3.4.0-02, =3.0.0-03, =3.5.0-02, =3.4.0-02, =3.17.0-01, =0.0.4, =3.17.0-01, =3.1.0-04, =3.1.0-04, =3.11.0-01, =0.0.2, =3.13.0-01, =1.0.4, =1.0.6 and more Source cves: CVE-2019-16530 Source advisory: OSV:GHSA-HMJV-PX3J-933Chttps...

org.sonatype.nexus.assemblies:nexus-base-template (>=3.4.0-02, <=3.18.1-01), org.sonatype.nexus.assemblies:nexus-core-feature (>=3.0.0-03, <=3.18.1-01) +22 more potentially affected by CVE-2019-16530 via org.sonatype.nexus:nexus-repository (>=3.0.0-03, <=3.18.1-01)

org.sonatype.nexus:nexus-repository MAVEN version =3.0.0-03, =3.4.0-02, =3.0.0-03, =3.5.0-02, =3.4.0-02, =3.17.0-01, =0.0.4, =3.17.0-01, =3.1.0-04, =3.1.0-04, =3.11.0-01, =0.0.2, =3.13.0-01, =1.0.4, =1.0.6 and more Source cves: CVE-2019-16530 Source advisory: GHSA-HMJV-PX3J-933Chttps://v...

GHSA-HMJV-PX3J-933C Unrestricted Upload of File with Dangerous Type in Sonatype Nexus Repository Manager

Sonatype Nexus Repository Manager 2.x before 2.14.15 and 3.x before 3.19, and IQ Server before 72, has remote code execution...

CVE-2022-27907

Sonatype Nexus Repository Manager 3.x before 3.38.0 allows SSRF...

CVE-2022-27907

Sonatype Nexus Repository Manager 3.x before 3.38.0 allows SSRF...

Server side request forgery (ssrf)

Sonatype Nexus Repository Manager 3.x before 3.38.0 allows SSRF...

CVE-2022-27907

Sonatype Nexus Repository Manager 3.x before 3.38.0 allows SSRF...

CVE-2022-27907

CVE-2022-27907 affects Sonatype Nexus Repository Manager 3.x before 3.38.0, with an SSRF vulnerability. Connected documents describe a code issue that forces the server to send a query request, enabling SSRF. Exploitation details are not provided in the sources; no in‑the‑wild exploit data is sta...

CVE-2022-27907

Sonatype Nexus Repository Manager 3.x before 3.38.0 allows SSRF...

PT-2022-18682

Name of the Vulnerable Software and Affected Versions Sonatype Nexus Repository Manager versions prior to 3.38.0 Description The issue allows for Server-Side Request Forgery SSRF, which is a type of attack where an attacker can trick a server into making requests to arbitrary domains. This can...