CVE-2020-10204: Remote Code Execution - JavaEL Injection in Nexus Repository Manager
Summary
CVE-2020-10204: Remote Code Execution - JavaEL Injection (low privileged accounts) in Nexus Repository Manager. Affects org.sonatype.nexus:nexus-core versions < 3.21.2. Fixed in 3.21.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Nexus Repository Manager is a popular package manager used in Maven ecosystem. It provides a centralized repository for storing and managing software components. The vulnerable package in question is org.sonatype.nexus:nexus-core. This vulnerability allows for remote code execution, which can have severe consequences for the affected system.
Vulnerability Detail
The vulnerability, identified as CVE-2020-10204, is a JavaEL Injection vulnerability in Sonatype Nexus Repository Manager before version 3.21.2. This vulnerability enables an attacker to execute arbitrary code remotely. By exploiting this vulnerability, an attacker can gain unauthorized access to the system and potentially perform malicious actions, such as modifying or stealing sensitive data.
How To Fix
Minimum fixed version
3.21.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to upgrade to the fixed version as soon as possible to eliminate the risk of remote code execution.
Conclusion
CVE-2020-10204 is a critical vulnerability in Nexus Repository Manager that allows for remote code execution. It is crucial to upgrade to version 3.21.2 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.sonatype.nexus:nexus-core →
FAQ
This vulnerability allows an attacker to execute arbitrary code remotely, potentially leading to unauthorized access, data theft, or system compromise.
You can use Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using just the pom.xml file.
Yes, upgrading Nexus Repository Manager to version 3.21.2 or later fixes this vulnerability.
No known mitigations are available for this vulnerability. Upgrading to the fixed version is the recommended course of action.
Yes, this vulnerability can be exploited remotely without requiring authentication.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.sonatype.nexus:nexus-core.
