Sonatype: >> Nexus Repository Manager >> 3.11.0 Security Vulnerabilities
An issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.17 and 3.x before 3.22.1. Admin users can retrieve the LDAP server system username/password (as configured in nxrm) in cleartext.
CVSS Score
4.9
EPSS Score
0.006
Published
2020-04-27
Sonatype Nexus Repository Manager 2.x before 2.14.15 and 3.x before 3.19, and IQ Server before 72, has remote code execution.
CVSS Score
7.2
EPSS Score
0.033
Published
2019-10-21
Sonatype Nexus Repository Manager before 3.17.0 establishes a default administrator user with weak defaults (fixed credentials).
CVSS Score
9.8
EPSS Score
0.015
Published
2019-07-08
Sonatype Nexus Repository Manager before 3.17.0 has a weak default of giving any unauthenticated user read permissions on the repository files and images.
CVSS Score
7.5
EPSS Score
0.014
Published
2019-07-08
CVE-2019-7238
Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control.
Known exploited
CVSS Score
9.8
EPSS Score
0.766
Published
2019-03-21
Sonatype Nexus Repository Manager before 3.14 allows XSS.
CVSS Score
6.1
EPSS Score
0.007
Published
2018-11-15
Sonatype Nexus Repository Manager before 3.14 has Incorrect Access Control.
CVSS Score
7.5
EPSS Score
0.011
Published
2018-11-15
Sonatype Nexus Repository Manager before 3.14 allows Java Expression Language Injection.
CVSS Score
7.2
EPSS Score
0.052
Published
2018-11-15
Sonatype Nexus Repository Manager versions 3.x before 3.12.0 has XSS in multiple areas in the Administration UI.
CVSS Score
4.8
EPSS Score
0.014
Published
2018-06-11
Page 4