CVE-2020-10199: Sonatype Nexus Repository Remote Code Execution Vulnerability
Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).
Other sources
Sonatype Nexus Repository contains an unspecified vulnerability that allows for remote code execution.
— CISA
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-10199?
CVE-2020-10199 is a vulnerability in Sonatype Nexus Repository that allows for remote code execution.
Who is affected by CVE-2020-10199?
Users of Sonatype Nexus Repository versions up to and including 3.21.2 are affected by CVE-2020-10199.
What is the severity of CVE-2020-10199?
CVE-2020-10199 has a severity rating of 8.8, which is considered critical.
How can I fix CVE-2020-10199?
To fix CVE-2020-10199, it is recommended to upgrade Sonatype Nexus Repository to a version beyond 3.21.2.
Where can I find more information about CVE-2020-10199?
You can find more information about CVE-2020-10199 at the following references: <ul><li><a href="http://packetstormsecurity.com/files/157261/Nexus-Repository-Manager-3.21.1-01-Remote-Code-Execution.html" target="_blank">http://packetstormsecurity.com/files/157261/Nexus-Repository-Manager-3.21.1-01-Remote-Code-Execution.html</a></li><li><a href="http://packetstormsecurity.com/files/160835/Sonatype-Nexus-3.21.1-Remote-Code-Execution.html" target="_blank">http://packetstormsecurity.com/files/160835/Sonatype-Nexus-3.21.1-Remote-Code-Execution.html</a></li><li><a href="https://cwe.mitre.org/data/definitions/917.html" target="_blank">https://cwe.mitre.org/data/definitions/917.html</a></li></ul>