CVE-2020-11753

An issue was discovered in Sonatype Nexus Repository Manager in versions 3.21.1 and 3.22.0. It is possible for a user with appropriate privileges to create, modify, and execute scripting tasks without use of the UI or API. NOTE: in 3.22.0, scripting is disabled by default making this not...

Design/Logic Flaw

An issue was discovered in Sonatype Nexus Repository Manager in versions 3.21.1 and 3.22.0. It is possible for a user with appropriate privileges to create, modify, and execute scripting tasks without use of the UI or API. NOTE: in 3.22.0, scripting is disabled by default making this not...

CVE-2020-11753

CVE-2020-11753 affects Sonatype Nexus Repository Manager versions 3.21.1 and 3.22.0. The issue allows a user with appropriate privileges to create, modify, and execute scripting tasks without using the UI or API. The note for 3.22.0 states scripting is disabled by default, making it not exploitab...

PT-2020-12823 · Sonatype · Sonatype Nexus Repository Manager +1

Name of the Vulnerable Software and Affected Versions: Sonatype Nexus Repository Manager versions 3.21.1 Description: An issue was discovered in Sonatype Nexus Repository Manager. It is possible for a user with appropriate privileges to create, modify, and execute scripting tasks without use of t...

Nexus Repository Manager - Java EL Injection RCE (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Nexus Repository Manager Java EL Injection RCE', 'Description' = %q This module exploits a Java Expression Language EL injection in Nexus...

Nexus Repository Manager 3.21.1-01 Remote Code Execution Exploit

This Metasploit module exploits a Java Expression Language EL injection in Nexus Repository Manager versions up to and including 3.21.1 to execute code as the Nexus user. Tested against 3.21.1-01. This module requires Metasploit: https://metasploit.com/download Current source:...

Nexus Repository Manager 3.21.1-01 Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Nexus Repository Manager Java EL Injection RCE', 'Description' = %q This module exploits a Java Expression Language EL injection in Nexus...

GHSA-3944-787C-F852 Persistent Cross-Site scripting in Nexus Repository Manager

Sonatype Nexus Repository before 3.21.2 allows XSS...

Persistent Cross-Site scripting in Nexus Repository Manager

Sonatype Nexus Repository before 3.21.2 allows XSS...

Remote Code Execution - JavaEL Injection (low privileged accounts) in Nexus Repository Manager

Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution...

Nexus Repository Manager Incorrect Access Control Vulnerability

Nexus Repository Manager is a repository manager from Sonatype that lets you proxy, collect, and manage your dependencies so you don't have to deal with a series of JARs on a regular basis, making it easy to distribute your software. An incorrect access control vulnerability exists in Nexus...

CVE-2020-11444

Sonatype Nexus Repository Manager 3.x up to and including 3.21.2 has Incorrect Access Control...

Improper access control

Sonatype Nexus Repository Manager 3.x up to and including 3.21.2 has Incorrect Access Control...

CVE-2020-11444

Sonatype Nexus Repository Manager 3.x up to and including 3.21.2 has Incorrect Access Control...

CVE-2020-11444

CVE-2020-11444 affects Sonatype Nexus Repository Manager 3.x up to 3.21.2, with an Incorrect Access Control flaw that enables unauthorized actions on the server. Red Hat and CNVD entries confirm the issue exists in Nexus 3.x; public exploit references show a workaround: an unauthenticated or mini...

Sonatype Nexus Repository Manager Command Execution Vulnerability

Sonatype Nexus Repository Manager NXRM is a Maven repository manager from Sonatype USA. A command execution vulnerability exists in Sonatype Nexus Repository Manager. An attacker can exploit this vulnerability to execute code...

Sonatype Nexus Repository Manager Command Execution Vulnerability (CNVD-2020-28477)

Sonatype Nexus Repository Manager NXRM is a Maven repository manager from Sonatype USA. A command execution vulnerability exists in Sonatype Nexus Repository Manager. An attacker can exploit this vulnerability to execute arbitrary code with the help of a malicious request...

Sonatype Nexus Repository Manager 3 Remote Code Execution (CVE-2019-7238)

A remote code execution vulnerability exists in Sonatype Nexus Repository Manager 3. This vulnerability is due to insufficient validation of the parameter in the previewAssets function. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the...

Command Execution Vulnerability in Nexus Repository Manager

Sonatype Nexus is a Maven repository management system that provides powerful repository management, component search, and can be used to build a Maven repository self-service to save bandwidth and time by maintaining a local repository while proxying a remote repository. A command execution...

CVE-2019-15588

There is an OS Command Injection in Nexus Repository Manager = 2.14.14 bypass CVE-2019-5475 that could allow an attacker a Remote Code Execution RCE. All instances using CommandLineExecutor.java with user-supplied data is vulnerable, such as the Yum Configuration Capability...