CVE-2019-5475: OS Command Injection in Nexus Yum Repository Plugin
Summary
CVE-2019-5475: OS Command Injection in Nexus Yum Repository Plugin. Affects org.sonatype.nexus.plugins:nexus-yum-repository-plugin versions < 2.14.14. Fixed in 2.14.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Nexus Yum Repository Plugin is a Maven package that provides functionality for managing Yum repositories in Nexus. It allows users to configure and manage Yum repositories within their Nexus instances. The plugin is widely used in software development and deployment processes.
Vulnerability Detail
The Nexus Yum Repository Plugin in version 2 is vulnerable to OS Command Injection. This vulnerability occurs when instances using the CommandLineExecutor.java class are supplied with vulnerable data, such as the Yum Configuration Capability. An attacker can exploit this vulnerability to execute arbitrary commands on the affected system, potentially leading to remote code execution. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Minimum fixed version
2.14.14
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to a patched version of the Nexus Yum Repository Plugin.
Conclusion
The Nexus Yum Repository Plugin in version 2 is vulnerable to OS Command Injection, which can lead to remote code execution. It is crucial to upgrade to version 2.14.14 or later to fix this vulnerability. No known workarounds exist, and it is recommended to apply the fix as soon as possible. For additional support, please contact DevNack.com.
See every vulnerability recorded for org.sonatype.nexus.plugins:nexus-yum-repository-plugin →
FAQ
This vulnerability allows an attacker to execute arbitrary commands on the affected system, potentially leading to remote code execution. It can result in unauthorized access, data breaches, and compromise of the entire system.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for any open-source vulnerabilities, including CVE-2019-5475.
At the time of this report, there are no known public exploits for this vulnerability. However, it is crucial to apply the recommended fix to mitigate the risk of potential exploitation.
Yes, this vulnerability can be exploited remotely. An attacker can send malicious requests to the affected system, triggering the OS Command Injection and potentially gaining unauthorized access or executing arbitrary code.
For further support on vulnerability remediation and assistance with securing your software, you can contact info@devnack.com. Their team of experts can provide guidance and help ensure the safety of your applications.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
