Vulnerabilidades de Sonatype

CVE-2026-97712 Alta · 8.7 CWE-862 15/10/2026

Nexus Repository 3 - Privilege Escalation via Role Management

Sonatype Nexus Repository 3 allows a user that holds the role create or role update permission to grant roles and privileges that the account does not hold. This can give the user more access than intended, up to full administrative access.

CVE-2026-97667 Média · 5.1 CWE-79 15/10/2026

Nexus Repository 3 - Stored Cross-Site Scripting in Browse UI

Sonatype Nexus Repository 3 allows a user account that holds the edit permission on a hosted R repository to store script content in the metadata of an uploaded R package. The script runs in the browser of a user who opens the details of that package in the Browse user interface, with the permissions of the viewing user. In this description, a user account means an account that has supplied valid credentials. The anonymous user, if enabled, is also a user account and can hold this permission if an administrator grants it.

CVE-2026-97666 Média · 6.9 CWE-470 15/10/2026

Nexus Repository 3 - Unsafe Reflection in ExtDirect Repository Endpoint

Sonatype Nexus Repository 3 allows an unauthenticated remote attacker to supply attacker-controlled input to a Java class loading call through an ExtDirect endpoint. This allows the attacker to learn whether specific classes are present in the application. The issue does not by itself allow code execution.

CVE-2026-97665 Alta · 7.1 CWE-862 15/10/2026

Nexus Repository 3 - Missing Authorization on NuGet Symbol Package Upload

A missing authorization check in Nexus Repository 3's NuGet Components API upload path allows an account holding only repository read and browse privileges to upload and persist NuGet symbol packages (.snupkg) to a hosted repository, bypassing the write-permission check enforced for ordinary package uploads. Exploitation requires a hosted NuGet repository with Symbol Server enabled. If anonymous access is enabled, the built-in anonymous user holds read and browse privileges across all repositories by default, so this precondition can also be met without an authenticated account.

CVE-2026-77121 Média · 6.5 CWE-770 02/09/2026

Nexus Repository 3 - Denial of Service via Unbounded Maven POM Metadata Fields

A user account with permission to deploy artifacts to a hosted Maven repository could upload a POM file containing an oversized metadata field. This causes future attempts to list or browse that repository's components to permanently fail until an administrator repairs the underlying data. Only the targeted repository is affected; other repositories and overall server health remain unaffected.

CVE-2026-10741 Média · 4.9 CWE-863 17/06/2026

Nexus Repository Manager - Incorrect Authorization allows credential disclosure via proxy repository configuration

Sonatype Nexus Repository Manager before 3.93.0 contains an authorization vulnerability in the proxy repository configuration that allows a delegated repository administrator to disclose stored upstream proxy credentials.

CVE-2026-10748 Alta · 7.2 CWE-502 16/06/2026

Nexus Repository 3 - Remote Code Execution via License Deserialization

An authenticated user with the nx-licensing-create privilege can upload a specially crafted license file to execute arbitrary operating system commands as the Nexus process user in Sonatype Nexus Repository 3 versions before 3.92.0.

CVE-2026-3329 Alta · 7.5 CWE-307 11/06/2026

Nexus Repository Manager - Improper Restriction of Excessive Authentication Attempts

A remote unauthenticated attacker may be able to conduct credential-guessing attacks against user accounts in Sonatype Nexus Repository via authentication endpoints.

CVE-2026-7308 Média · 5.4 CWE-79 11/05/2026

Nexus Repository 3 - Stored Cross-Site Scripting (XSS) via HTML Browse Page

An authenticated user with upload permission to a hosted repository can store content that causes arbitrary JavaScript to execute in the browser of any user who browses that repository directory via the HTML index page in Sonatype Nexus Repository versions 3.6.0 through versions before 3.92.0. This could allow the attacker to perform actions in the context of the victim's session.

CVE-2026-3048 Baixa · 3.8 CWE-502 11/05/2026

Nexus Repository 3 - Improper LDAP Referral Handling

An authenticated administrator who configures or tests LDAP connectivity in Sonatype Nexus Repository Manager versions 3.0.0 through 3.91.1 may be able to initiate unintended server-side connections when interacting with a malicious LDAP server.

CVE-2026-5189 Crítica · 9.8 CWE-798 15/04/2026

Nexus Repository 3 - Hardcoded Credential in Internal Database Component

CWE-798: Use of Hard-coded Credentials in Sonatype Nexus Repository Manager versions 3.0.0 through 3.70.5 allows an unauthenticated attacker with network access to gain unauthorized read/write access to the internal database and execute arbitrary OS commands as the Nexus process user. Exploitation requires the non-default nexus.orient.binaryListenerEnabled=true configuration to be enabled.

CVE-2026-3438 Média · 6.1 CWE-79 08/04/2026

Nexus Repository 3 - Reflected Cross-Site Scripting (XSS) in ?describe Pages

A reflected cross-site scripting vulnerability exists in Sonatype Nexus Repository versions 3.0.0 through 3.90.2 that allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser through a specially crafted URL. Exploitation requires user interaction.

CVE-2026-3199 Alta · 8.8 CWE-502 08/04/2026

Nexus Repository 3 - Authenticated Remote Code Execution via Task Property Injection

A vulnerability in the task management component of Sonatype Nexus Repository versions 3.22.1 through 3.90.2 allows an authenticated attacker with task creation permissions to execute arbitrary code, bypassing the nexus.scripts.allowCreation security control.

CVE-2026-0600 Média · 6.2 CWE-918 14/01/2026

Nexus Repository 3 - Server-Side Request Forgery in Proxy Repository Configuration

Server-Side Request Forgery (SSRF) vulnerability in Sonatype Nexus Repository 3 versions 3.0.0 and later allows authenticated administrators to configure proxy repositories with URLs that can access unintended network destinations, potentially including cloud metadata services and internal network resources. A workaround configuration is available starting in version 3.88.0, but the product remains vulnerable by default.

CVE-2026-0601 Média · 5.1 CWE-79 14/01/2026

Nexus Repository 3 - Cross-Site Scripting

A reflected cross-site scripting vulnerability exists in Nexus Repository 3 that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser through a specially crafted request requiring user interaction.

CVE-2025-13488 Média · 5.1 CWE-79 04/12/2025

Nexus Repository 3 - Stored Cross-Site Scripting (XSS)

Due to a regression introduced in version 3.83.0, a security header is no longer applied to certain user-uploaded content served from repositories. This may allow an authenticated attacker with repository upload privileges to exploit a stored cross-site scripting (XSS) vulnerability with user context.

CVE-2020-10199 Alta · 8.8 KEV Urgente · 76 Exploit público CWE-917 01/04/2020

Sonatype Nexus Repository Remote Code Execution Vulnerability

Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).

CVE-2019-7238 Crítica · 9.8 KEV Alta · 67 Exploit público 21/03/2019

Sonatype Nexus Repository Manager Incorrect Access Control Vulnerability

Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control.