Sonatype Nexus — known CVE vulnerabilities

Every CVE whose affected-product data names Sonatype Nexus, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (8)

• CVE-2020-11444 — CVSS 8.8 (high): Sonatype Nexus Repository Manager 3.x up to and including 3.21.2 has Incorrect Access Control.
• CVE-2020-10199 — CVSS 8.8 (high) — actively exploited: Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).
• CVE-2014-2034 — CVSS 7.5 (high): Unspecified vulnerability in Sonatype Nexus OSS and Pro 2.4.0 through 2.7.1 allows attackers to create arbitrary user accounts via unknown…
• CVE-2014-9389 — CVSS 7.5 (high): Directory traversal vulnerability in Sonatype Nexus OSS and Pro before 2.11.1-01 allows remote attackers to read or write to arbitrary…
• CVE-2014-0792 — CVSS 7.5 (high): Sonatype Nexus 1.x and 2.x before 2.7.1 allows remote attackers to create arbitrary objects and execute arbitrary code via unspecified…
• CVE-2020-10204 — CVSS 7.2 (high): Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution.
• CVE-2020-24622 — CVSS 4.9 (medium): In Sonatype Nexus Repository 3.26.1, an S3 secret key can be exposed by an admin user.
• CVE-2020-10203 — CVSS 4.8 (medium): Sonatype Nexus Repository before 3.21.2 allows XSS.