CVE-2014-0792: Code Injection
Published Jan 17, 2014
·Updated
Sonatype Nexus 1.x and 2.x before 2.7.1 allows remote attackers to create arbitrary objects and execute arbitrary code via unspecified vectors related to unmarshalling of unintended Object types.
Affected Software
25 affected components
Sonatype Nexus=1.0
Sonatype Nexus=2.0
Sonatype Nexus=2.0.1
Sonatype Nexus=2.0.2
Sonatype Nexus=2.0.3
Sonatype Nexus=2.0.4
Sonatype Nexus=2.0.4-1
Sonatype Nexus=2.0.5
Sonatype Nexus=2.0.6
Sonatype Nexus=2.1
Sonatype Nexus=2.1.1
Sonatype Nexus=2.2
Sonatype Nexus=2.3.1
Sonatype Nexus=2.4.0
Sonatype Nexus=2.5.0
Sonatype Nexus=2.5.1
Sonatype Nexus=2.6.0
Sonatype Nexus=2.6.1
Sonatype Nexus=2.6.2
Sonatype Nexus=2.6.3
Sonatype Nexus=2.6.4
Sonatype Nexus=2.7.0
Sonatype Nexus=2.7.0-04
Sonatype Nexus=2.7.0-05
Sonatype Nexus=2.7.0-06
Remediation
Patch Available
Event History
Jan 17, 2014
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Data Sourced
via NVD·08:55 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2014-0792?
CVE-2014-0792 has a critical severity level due to the ability for remote attackers to execute arbitrary code.
2
How do I fix CVE-2014-0792?
To address CVE-2014-0792, upgrade Sonatype Nexus to version 2.7.1 or later.
3
What software versions are affected by CVE-2014-0792?
CVE-2014-0792 affects Sonatype Nexus versions 1.x and 2.x prior to 2.7.1.
4
Can CVE-2014-0792 be exploited remotely?
Yes, CVE-2014-0792 can be exploited remotely by attackers to create arbitrary objects.
5
What should I do if I'm using an affected version of Sonatype Nexus?
If you are using an affected version of Sonatype Nexus, you should immediately upgrade to the latest version to mitigate the vulnerability.