Vendor
Sonatype
49 known vulnerabilities.
Products
21 results · Clear filters · Feed
-
High 7.7
Nexus Repository 3 - SQL Injection in Reindex Search by Pattern Task
Sonatype Nexus Repository 3 contains a SQL injection vulnerability in the optional "Reindex Search Tables By Pattern" task. A user who holds the nexus:tasks:create privilege can supply a crafted filter condition that the database runs as SQL. This allows the …
-
High 7.1
Nexus Repository 3 - Insufficiently Protected Credentials in Repository Signing Passphrase
Sonatype Nexus Repository 3 returns the signing passphrase of an APT or YUM repository, through an internal REST endpoint, to a user account that holds only the read privilege for administering that repository. The account does not need the privilege to edit …
-
High 8.6
Nexus Repository 3 - Privilege Escalation via Rut Auth Capability Creation
Sonatype Nexus Repository 3 does not require realm administration permission when a user creates a Rut Auth capability. A user who holds only the capability creation permission (nexus:capabilities:create) can create this capability, which turns on header-base…
-
High 7.1
Nexus Repository 3 - Insufficiently Protected Credentials in YUM Repository Signing Key
Sonatype Nexus Repository 3 returns the private signing key of a YUM proxy or group repository to an account that holds only the read privilege for administering that repository. The account does not need the privilege to edit the repository. A party that hol…
-
High 7.1
Nexus Repository 3 - Missing Authorization on NuGet Symbol Package Upload
A missing authorization check in Nexus Repository 3's NuGet Components API upload path allows an account holding only repository read and browse privileges to upload and persist NuGet symbol packages (.snupkg) to a hosted repository, bypassing the write-permi…
-
High 8.7
Nexus Repository 3 - Privilege Escalation via Role Management
Sonatype Nexus Repository 3 allows a user that holds the role create or role update permission to grant roles and privileges that the account does not hold. This can give the user more access than intended, up to full administrative access.
-
High 7.1
Nexus Repository 3 - Incorrect Authorization on Blobstore Group Endpoints
A vulnerability was identified in Sonatype Nexus Repository 3 in which two blobstore group management REST API endpoints did not correctly enforce the intended authorization check. A user granted only the nexus:blobstores:create permission could invoke these …
-
High 7.5
Nexus Repository 3 - Script Execution Disable Setting Not Enforced
In affected versions of Nexus Repository 3, the script execution endpoint (POST /service/rest/v1/script/{name}/run) did not verify whether script execution had been administratively disabled. An account holding script-execution permission could continue to ru…
-
High 7.2
Nexus Repository - Arbitrary Class Instantiation via Unsafe Realm Configuration
An account holding the nexus:settings:update permission in Nexus Repository 3 (or the equivalent nexus:settings permission in the legacy Nexus Repository 2) could submit arbitrary values as realm identifiers through an internal configuration API that did not …
-
High 8.2CVE-2026-17594 Scanner template
Nexus Repository 3 - Authorization Bypass in Repository Creation
Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x contain an incorrect authorization vulnerability (CWE-863) in the repository-creation user interface. An individual user account holding a delegated repository-admin privilege scoped to a specific reposi…
-
High 8.6
Nexus Repository 3 - Privilege Escalation
Nexus Repository 3 contained a privilege escalation vulnerability in the REST privileges API. An authenticated user with permission to manage privileges could, under certain role configurations, escalate their own access to full administrator by exploiting a …
-
High 8.7
Nexus Repository 3 - Session Not Invalidated on User Account Deletion or Deactivation
Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke their cached permissions when that user's account was deleted, deactivated, or had its password changed. A user whose account was already logged in at the time o…
-
High 8.9
Nexus Repository 3 - Wildcard Privilege Update Self-Escalation to Administrator
A user holding a permission to update privilege definitions could modify a wildcard privilege already assigned to their own role to grant broader permissions than they were authorized to hold, including full administrative access, without any additional autho…
-
High 8.7
Nexus Repository 3 - HikariCP connectionInitSql Injection RCE via DataStore Configuration API
Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could be set through the DataStore configuration API. A user holding the nx-datastores-update permission could set the connectionInitSql property to execute arbitrary S…
-
High 8.2
Nexus Repository 3 - Authorization Bypass in Component Upload API
An authorization bypass in Nexus Repository 3's component upload API allowed a user with only read/browse privileges on a Swift, Terraform, or Conda hosted repository to upload arbitrary artifacts, bypassing the intended write-permission check.
-
High 8.7
Nexus Repository Manager - Insufficient Entropy in Format-Specific API Key Generation
A vulnerability in Sonatype Nexus Repository Manager's format-specific API key generation may allow a remote attacker to gain unauthorized access to repository operations as a targeted user. A format-specific API key realm (NuGet API Key, Docker Bearer Token,…
-
High 8.6
Nexus Repository 3 - Remote Code Execution via License Deserialization
An authenticated user with the nx-licensing-create privilege can upload a specially crafted license file to execute arbitrary operating system commands as the Nexus process user in Sonatype Nexus Repository 3 versions before 3.92.0.
-
High 8.7
Nexus Repository Manager - Improper Restriction of Excessive Authentication Attempts
A remote unauthenticated attacker may be able to conduct credential-guessing attacks against user accounts in Sonatype Nexus Repository via authentication endpoints.
-
High 8.7
Nexus Repository 2 - SSRF Vulnerability in Remote Browser Plugin
Server-Side Request Forgery (SSRF) in the Remote Browser Plugin in Sonatype Nexus Repository 2.x up to and including 2.15.2 allows unauthenticated remote attackers to exfiltrate proxy repository credentials via crafted HTTP requests.
-
High 7.1
Nexus Repository 2 - Remote Code Execution
A Remote Code Execution vulnerability has been discovered in Sonatype Nexus Repository 2. This issue affects Nexus Repository 2 OSS/Pro versions up to and including 2.15.1.
-
High 7.5
Nexus Repository 3 - Path Traversal
Path Traversal in Sonatype Nexus Repository 3 allows an unauthenticated attacker to read system files. Fixed in version 3.68.1.