CVE-2024-5764

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-5764
Use of Hard-coded Credentials vulnerability in Sonatype Nexus Repository has been discovered in the code responsible for encrypting any secrets stored in the Nexus Repository configuration database (SMTP or HTTP proxy credentials, user tokens, tokens, among others). The affected versions relied on a static hard-coded encryption passphrase. While it was possible for an administrator to define an alternate encryption passphrase, it could only be done at first boot and not updated. This issue affects Nexus Repository: from 3.0.0 through 3.72.0.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://support.sonatype.com/hc/en-us/articles/34496708991507 Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:sonatype:nexus:*:*:*:*:*:*:*:*
History

06 Nov 2024, 16:41

Type Values Removed Values Added
References () https://support.sonatype.com/hc/en-us/articles/34496708991507 - () https://support.sonatype.com/hc/en-us/articles/34496708991507 - Vendor Advisory
CPE cpe:2.3:a:sonatype:nexus:*:*:*:*:*:*:*:*
First Time Sonatype nexus
Sonatype
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5

25 Oct 2024, 12:56

Type Values Removed Values Added
Summary
  • (es) Se ha descubierto una vulnerabilidad de uso de credenciales codificadas de forma rígida en Sonatype Nexus Repository en el código responsable de cifrar los secretos almacenados en la base de datos de configuración del Repositorio Nexus (credenciales de proxy SMTP o HTTP, tokens de usuario, tokens, entre otros). Las versiones afectadas se basaban en una frase de contraseña de cifrado estática y codificada de forma rígida. Si bien era posible que un administrador definiera una frase de contraseña de cifrado alternativa, solo se podía hacer en el primer arranque y no se actualizaba. Este problema afecta al Repositorio Nexus: desde la versión 3.0.0 hasta la 3.72.0.

23 Oct 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-10-23 15:15

Updated : 2024-11-06 16:41

NVD link : CVE-2024-5764

Mitre link : CVE-2024-5764

CVE.ORG link : CVE-2024-5764

JSON object : View

Products Affected

sonatype

  • nexus
CWE
CWE-798

Use of Hard-coded Credentials