Sonatype: >> Nexus Repository Manager >> 3.15.0 Security Vulnerabilities
Sonatype Nexus Repository Manager OSS/Pro version before 3.25.1 allows Remote Code Execution.
CVSS Score
8.8
EPSS Score
0.022
Published
2020-07-31
An issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.17 and 3.x before 3.22.1. Admin users can retrieve the LDAP server system username/password (as configured in nxrm) in cleartext.
CVSS Score
4.9
EPSS Score
0.006
Published
2020-04-27
Sonatype Nexus Repository Manager 2.x before 2.14.15 and 3.x before 3.19, and IQ Server before 72, has remote code execution.
CVSS Score
7.2
EPSS Score
0.033
Published
2019-10-21
In Nexus Repository Manager before 3.18.0, users with elevated privileges can create stored XSS.
CVSS Score
5.4
EPSS Score
0.011
Published
2019-08-22
Sonatype Nexus Repository Manager before 3.17.0 establishes a default administrator user with weak defaults (fixed credentials).
CVSS Score
9.8
EPSS Score
0.015
Published
2019-07-08
Sonatype Nexus Repository Manager before 3.17.0 has a weak default of giving any unauthenticated user read permissions on the repository files and images.
CVSS Score
7.5
EPSS Score
0.014
Published
2019-07-08
Page 4