Sonatype Nexus Repository Manager — known CVE vulnerabilities
Every CVE whose affected-product data names Sonatype Nexus Repository Manager, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.
CVEs (29)
CVE-2017-17717 — CVSS 9.8 (critical): Sonatype Nexus Repository Manager through 2.14.5 has weak password encryption with a hardcoded CMMDwoV value in the LDAP integration…
CVE-2019-9629 — CVSS 9.8 (critical): Sonatype Nexus Repository Manager before 3.17.0 establishes a default administrator user with weak defaults (fixed credentials).
CVE-2019-5475 — CVSS 8.8 (high): The Nexus Yum Repository Plugin in v2 is vulnerable to Remote Code Execution when instances using CommandLineExecutor.java are supplied…
CVE-2020-15012 — CVSS 8.6 (high): A Directory Traversal issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.19. A user that requests a crafted path can…
CVE-2019-9630 — CVSS 7.5 (high): Sonatype Nexus Repository Manager before 3.17.0 has a weak default of giving any unauthenticated user read permissions on the repository…
CVE-2019-16530 — CVSS 7.2 (high): Sonatype Nexus Repository Manager 2.x before 2.14.15 and 3.x before 3.19, and IQ Server before 72, has remote code execution.
CVE-2019-15588 — CVSS 7.2 (high): There is an OS Command Injection in Nexus Repository Manager <= 2.14.14 (bypass CVE-2019-5475) that could allow an attacker a Remote Code…
CVE-2020-29436 — CVSS 6.5 (medium): Sonatype Nexus Repository Manager 3.x before 3.29.0 allows a user with admin privileges to configure the system to gain access to content…
CVE-2024-5764 — CVSS 6.5 (medium): Use of Hard-coded Credentials vulnerability in Sonatype Nexus Repository has been discovered in the code responsible for encrypting any…
CVE-2021-29159 — CVSS 6.1 (medium): A cross-site scripting (XSS) vulnerability has been discovered in Nexus Repository Manager 3.x before 3.30.1. An attacker with a local…
CVE-2021-37152 — CVSS 5.4 (medium): Multiple XSS issues exist in Sonatype Nexus Repository Manager 3 before 3.33.0. An authenticated attacker with the ability to add HTML…
CVE-2021-30635 — CVSS 5.3 (medium): Sonatype Nexus Repository Manager 3.x before 3.30.1 allows a remote attacker to get a list of files and directories that exist in a…
CVE-2020-11415 — CVSS 4.9 (medium): An issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.17 and 3.x before 3.22.1. Admin users can retrieve the LDAP…
CVE-2018-12100 — CVSS 4.8 (medium): Sonatype Nexus Repository Manager versions 3.x before 3.12.0 has XSS in multiple areas in the Administration UI.
CVE-2021-42568 — CVSS 4.3 (medium): Sonatype Nexus Repository Manager 3.x through 3.35.0 allows attackers to access the SSL Certificates Loading function via a low-privileged…
CVE-2021-34553 — CVSS 4.3 (medium): Sonatype Nexus Repository Manager 3.x before 3.31.0 allows a remote authenticated attacker to get a list of blob files and read the content…