CVE-2020-10199: Nexus Repository Manager 3 - Remote Code Execution
Summary
CVE-2020-10199: Nexus Repository Manager 3 - Remote Code Execution. Affects org.sonatype.nexus:nexus-extdirect versions < 3.21.2. Fixed in 3.21.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Nexus Repository Manager is a popular package manager used for managing and distributing software components. It provides a central repository for storing and retrieving packages, making it easier for developers to manage dependencies. The vulnerability identified as CVE-2020-10199 affects versions of Nexus Repository Manager prior to 3.21.2.
Vulnerability Detail
The vulnerability in Nexus Repository Manager 3.21.2 is related to JavaEL Injection. This vulnerability allows an attacker to inject malicious code into the application, potentially leading to remote code execution. The impact of this vulnerability is significant, as it can allow an attacker to gain unauthorized access to the system, execute arbitrary commands, and potentially compromise the entire infrastructure. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Minimum fixed version
3.21.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version as soon as possible to mitigate the risk of exploitation.
Conclusion
The vulnerability in Nexus Repository Manager 3.21.2 allows for JavaEL Injection, which can lead to remote code execution. To mitigate this vulnerability, it is crucial to upgrade to version 3.21.2 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.sonatype.nexus:nexus-extdirect →
FAQ
Nexus Repository Manager is a package manager used for managing and distributing software components. It provides a central repository for storing and retrieving packages, making it easier for developers to manage dependencies.
JavaEL Injection is a vulnerability that allows an attacker to inject malicious code into an application by exploiting the Java Expression Language (EL) feature. This can lead to remote code execution and unauthorized access to the system.
The impact of this vulnerability is significant. An attacker can exploit it to execute arbitrary code, gain unauthorized access to the system, and potentially compromise the entire infrastructure.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
To fix this vulnerability, it is recommended to upgrade Nexus Repository Manager to version 3.21.2 or later.
