Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).
References
Link | Resource |
---|---|
http://packetstormsecurity.com/files/157261/Nexus-Repository-Manager-3.21.1-01-Remote-Code-Execution.html | Patch Third Party Advisory VDB Entry |
http://packetstormsecurity.com/files/160835/Sonatype-Nexus-3.21.1-Remote-Code-Execution.html | Exploit Third Party Advisory VDB Entry |
https://cwe.mitre.org/data/definitions/917.html | Third Party Advisory |
https://support.sonatype.com/hc/en-us/articles/360044882533 | Patch Vendor Advisory |
Configurations
History
07 Oct 2022, 13:15
Type | Values Removed | Values Added |
---|---|---|
References | (MISC) https://cwe.mitre.org/data/definitions/917.html - Third Party Advisory |
10 Jul 2022, 21:15
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-917 | |
References |
|
Information
Published : 2020-04-01 19:15
Updated : 2024-02-04 21:00
NVD link : CVE-2020-10199
Mitre link : CVE-2020-10199
CVE.ORG link : CVE-2020-10199
JSON object : View
Products Affected
sonatype
- nexus
CWE
CWE-917
Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')